IPSEC not working

jimp

It doesn't look like a new update has built since before this fix.

There is also another fix pending because it wasn't automatically adding the firewall rules for NAT-T (udp/4500).

With that fix, and the mkdir fix, it should be working fine as far as I can tell. Hopefully another snapshot will build today (probably not until this evening at the earliest, if what I have heard is any indication) but we'll see.

fastcon68

Thanks for the update. It's been a pleasure working with you on few of the things.
RC

ankaerith

I'm running snapshot: pfSense-Full-Update-1.2.3-20090605-1539.tgz

It looks like something in the new ipsec-tools package or one of the changes broke an aspect of IPSec.

I have multiple tunnels between my home network and my office with the same destination gateway. Basically there are multiple subnets at the office and you need 1 tunnel per subnet.

I had the following tunnels for example:

Remote Gateway: 1.2.3.4
Local net: 172.20.20.0 /24
Remote net: 192.168.1.0 /24

Remote Gateway: 1.2.3.4
Local net: 172.20.20.0 /24
Remote net: 10.10.10.0 /24

Remote Gateway: 1.2.3.4
Local net: 172.20.20.0 /24
Remote net: 172.16.10.0 /24

With the latest snapshot if there is more than 1 tunnel for the same endpoint it returns the following error:

Jun 5 18:47:56 pfsense racoon: ERROR: no configuration found for 1.2.3.4.

As soon as I delete all but a single tunnel per remote gateway that one tunnel recovers.

I also have been catching the following errors:

Jun 5 18:47:40 pfsense racoon: ERROR: Cookie mismatch in DPD ACK!.

It looks like as a result of this error, DPD is killing the tunnel every time the interval trips.

I also see this error every couple minutes:

Jun 5 19:09:09 pfsense racoon: WARNING: unrecognized route message with rtm_type: 18

jimp

I haven't tried parallel tunnels with 0.8 yet, but I can see why DPD might freak out.

Have you tried setting DPD to 0 for all tunnels?

ankaerith

I had unset DPD and it stopped the tunnels from being killed every interval. It did not help with parallel tunnels.

jimp

It looks like ipsec-tools is going to be backed down to 0.7.2 or so, with an added patch or two, instead of all the way up to 0.8. Not sure when those changes will happen though.

ankaerith

Well, for what it's worth, the issues I described in http://forum.pfsense.org/index.php/topic,14688.0.html were resolved in 1.2.3 w/ the 0.8 ipsec-tools. Of course, a lack of parallel tunnels is a rather big problem.

jimp

That is an issue that will be patched if it is reverted to 0.7.2.

The other person I heard of having trouble with 0.8 also turned out to be a parallel tunnel issue, so that does seem to be broken.

If we can get 0.7.2 patches so that DPD actually works properly, it will hopefully be stable and usable by everyone.

luma

As of the 1.2.3-RC2 built on Sun Jun 14 18:15:10 EDT 2009, parallel tunnel are working.

But I'm not using DPD so I cannot try. What's the status about this?

Thanks and regards

jimp

ipsec-tools was backed down to 0.7.2, but I have a patch in that should be helping DPD (or breaking it worse depending on which snapshot is in use). Parallel tunnels work fine with 0.7.2, so that's probably why it's working fine for you.

I'm waiting on a response from the ipsec-tools developers, hopefully they will have some insight.

luma

Thanks for your answer jimp.

I will try to do some testing with the next patch.

Keep the good job!

Papa Midnight

I've never gotten IPsec to work properly when going through pfSense. I even tried running it on a VM which worked fine if attempted internally, but try to do it through WAN and you can expect failure. Connections were subsequently denied, even with the proper ports opened.

heiko

with which version from PfSense?, 1.2 works and the latest 1.23 r2 snapshot works also. I have running 1.2 (carp cluster) with ipsec up and running and the uptime is 458 days….

regards
heiko

fastcon68

I have been running IPSEC for over 2 years many flavors of PF-Sense no Issues. Except with the issue with one firmware update.
RC

cmb

@Papa:

I've never gotten IPsec to work properly when going through pfSense. I even tried running it on a VM which worked fine if attempted internally, but try to do it through WAN and you can expect failure. Connections were subsequently denied, even with the proper ports opened.

You're not doing something right. Start a new thread describing your problem.

The issue in this thread was the 0.8 ipsec-tools version we were testing, which is no longer a problem. Locking thread to prevent further hijacking, as nobody has the same issue as this thread covers.