Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSEC on OPT1/WAN2?

    Scheduled Pinned Locked Moved IPsec
    17 Posts 5 Posters 8.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      Phobia
      last edited by

      This was completely wrong… (deleted)

      1 Reply Last reply Reply Quote 0
      • dotdashD
        dotdash
        last edited by

        Actually, my IpSec tunnels on WAN2 are working with a route like this:
        @Wasca:

        Interface              Network                          Gateway                   
        WAN2        Remote End IPSEC WAN IP/32      WAN2 Gateway IP

        The LAN one doesn't make sense to me, as the problem is the box trying to establish the tunnel from the WAN, not OPT1/WAN2. The remote LAN should not be a factor until after the tunnel is established.

        1 Reply Last reply Reply Quote 0
        • P
          Phobia
          last edited by

          Yeah - but that doesn't help you to route packets over your IPSEC tunnel via the WAN2 interface from LAN.  That is what this static route is for.

          – Phob

          1 Reply Last reply Reply Quote 0
          • H
            hoba
            last edited by

            Don't use gateways for IPSEC-Traffic. This will redirect the traffic directly to the upstream gateway and won't send it into the tunnel. Use gateway default for these rules.

            1 Reply Last reply Reply Quote 0
            • P
              Phobia
              last edited by

              This was the only way I could get anything to work over my IPSEC tunnel on WAN2 - is there another way?

              1 Reply Last reply Reply Quote 0
              • P
                Phobia
                last edited by

                … or is the route needed for WAN2 and not LAN?  I'm not at the location with this setup right now - I will be later tonight and I'll take a look.

                -- Phob

                1 Reply Last reply Reply Quote 0
                • H
                  hoba
                  last edited by

                  Sorry, but that doesn't make any sense. That definately won't work this way. It's simply wrong.

                  You need the static route at the wan2 interface for the remote endpoint/32 through ewan2 gateway. Besides that all firewallrules have to use the default gateway so traffic can make it into the tunnel.

                  1 Reply Last reply Reply Quote 0
                  • GruensFroeschliG
                    GruensFroeschli
                    last edited by

                    @hoba: Something that always confused me a bit about the static routes:

                    Is the "Interface" (first thingy in the static route)
                    the interface on which traffic goes out,
                    or the interface to which the route applies to on incomming traffic?

                    We do what we must, because we can.

                    Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                    1 Reply Last reply Reply Quote 0
                    • H
                      hoba
                      last edited by

                      it's the interface that the gateway for the remote subnet is located behind.

                      1 Reply Last reply Reply Quote 0
                      • P
                        Phobia
                        last edited by

                        Right - OK.  So the static route is :

                        WAN2  (Remote IPSEC Gateway/Public IP)  WAN2 GW

                        Correct?

                        I was just confused as I'm working in a different location without this setup right now and I got turned around in my brain. :)

                        – Phob

                        1 Reply Last reply Reply Quote 0
                        • H
                          hoba
                          last edited by

                          Correct, besides that it is: WAN2, <remote ipsec="" endpoint="" ip="">/32,<wan2-gateway-ip></wan2-gateway-ip></remote>

                          1 Reply Last reply Reply Quote 0
                          • P
                            Phobia
                            last edited by

                            LOL - OK, total brainfart as that is how it is setup at the my other location.  Oops … like I said at the beginning, mesa confused! :)

                            Thanks as usual guys.

                            -- Phob

                            1 Reply Last reply Reply Quote 0
                            • M mik256 referenced this topic on
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.