• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

IPSec Road Warrior with NAT-T Question

Scheduled Pinned Locked Moved IPsec
14 Posts 4 Posters 13.0k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    jimp Rebel Alliance Developer Netgate
    last edited by Apr 28, 2009, 4:29 PM

    Are you sure you have the proper identifier/psk setup for the client? Just going by what it says, it looks like it can't find a proper matching key for the connection. Double check what you have entered in the pfSense side on the Pre-Shared Keys tab, and make sure it matches with the identifier used in the Shrew Soft client on its Authentication tab.

    I haven't tested NAT-T w/IPSec yet, but I'm not sure you really need that if their other routers have IPSec passthrough capability. Either way, I don't think that is the source of your issue or a contributing factor.

    Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

    Need help fast? Netgate Global Support!

    Do not Chat/PM for help!

    1 Reply Last reply Reply Quote 0
    • F
      FooFighter
      last edited by Apr 30, 2009, 9:22 AM

      Thank you for the info.

      I'm thinking of setting up a virtual network with two subnets via vmware to have an easier access to both ends of the vpn so I hopefully can better debug my problems :)

      Regards,

      Foo

      1 Reply Last reply Reply Quote 0
      • F
        FooFighter
        last edited by Jun 17, 2009, 7:43 PM Jun 17, 2009, 5:42 AM

        Update:

        Got this up an running with PFSENSE 1.2.3 RC2 - family/friends fully connected  ;D
        Main problem was my misunderstanding of the setting "Server Identifier: IP Address"
        I had set my DynDNS domain name in pfSense but the client settings were set to expected an IP Address.

        Finally the Shrewsoft trace util (debug) pointed me to the right direction
        –-

        1 Reply Last reply Reply Quote 0
        • P
          PFUser
          last edited by Jul 29, 2009, 6:25 AM Jul 29, 2009, 6:21 AM

          I am sorry for this question but:  ???
          What data did you enter in the "Server Identifier: IP Address" field.
          I have tried

          1. I have used the data under “Client Configuration” > “General Tab:” > “Host: <pfsense box="" wan="" ip="">”
            In my case in was 24.X.X.X

          2. I have used the data under “Client Configuration” > “General Tab:” > “Address: (pick some other random range you are not using, like 192.168.111.xx)”
            In my case in was 172.21.30.253

          3. I have used the data under “Client Configuration” > “Policy:” > “Address: (Network behind pfSense you want to access, e.g. 192.168.1.0)”
            In my case in was 172.21.30.0

          4. The IP on the computer that I have the client IPSec software on.
            In my case in was 192.168.168.103

          5. The Public IP of the Linksys WRT54G that my computer with the client IPSec sites behind.
            In my case in was 68.X.X.X

          But none of there seems to work.</pfsense>

          1 Reply Last reply Reply Quote 0
          • J
            jimp Rebel Alliance Developer Netgate
            last edited by Jul 29, 2009, 2:04 PM

            @PFUser:

            I am sorry for this question but:  ???
            What data did you enter in the "Server Identifier: IP Address" field.

            On the Shrew Soft client?

            Remote Identity:
              Type: IP Address

            Use Discovered remote host address

            Or which setting on what software are you referring to, exactly?

            Usually the server identifier is left blank on pfSense unless you know better.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • P
              PFUser
              last edited by Jul 29, 2009, 3:33 PM

              I am following this.
              http://doc.pfsense.org/index.php/IPSec_Road_Warrior/Mobile_Client_How-To

              On the PFSense config side.

              SNIP**************
              Fill in the settings as follows:

              Phase 1 Proposal (authentication):
              Negotiation Mode      : Aggressive
              Server Identifier    : IP Address
              Encryption Algorithm  : 3DES
              Hash Algorithm        : SHA1
              DH Key Group          : 2
              Lifetime              : 86400
              Authentication Method : Pre-Shared Key
              SNIP************

              1 Reply Last reply Reply Quote 0
              • J
                jimp Rebel Alliance Developer Netgate
                last edited by Jul 29, 2009, 3:40 PM

                I believe that should really be set to "My IP Address" in the drop-down box.

                I updated the howto.

                Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                Need help fast? Netgate Global Support!

                Do not Chat/PM for help!

                1 Reply Last reply Reply Quote 0
                • P
                  PFUser
                  last edited by Jul 29, 2009, 4:43 PM

                  Thank you for your response.

                  I have two other questions but it depends on the answer to this one.
                  In this part of the tutorial,

                  Under “Client Configuration” > “General Tab:” > “Address: (pick some other random range you are not using, like 192.168.111.xx)”

                  1. Is the “range” that you are referring to an unused IP that in not being used on your LAN side of your pfSense firewall.
                  2. Or is it a New subnet that is not in LAN subnet like 10.10.10.2 if you have a setup like below.

                  Example


                  192.168.1.1 LAN < pfSense > WAN 69.59.43.3


                  1 Reply Last reply Reply Quote 0
                  • J
                    jimp Rebel Alliance Developer Netgate
                    last edited by Jul 29, 2009, 5:07 PM

                    It is a new subnet that does not exist on any other interface to which pfSense can directly connect.

                    Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                    Need help fast? Netgate Global Support!

                    Do not Chat/PM for help!

                    1 Reply Last reply Reply Quote 0
                    • P
                      PFUser
                      last edited by Jul 29, 2009, 6:00 PM

                      Thank you once again.
                      And rebooting my client PC everything started to work.
                      The following is just for informational use only:

                      I made up a new IPSec VPN pool is IP subnet 10.10.10.0/24 that was not on my any interface on my pfSense firewall.

                      In the tutorial under the “Client Configuration” > “General Tab:” > “Address:” and “Netmask:”
                      I added this on my Shrew Soft client:
                      Address: 10.10.10.2
                      Netmask: 255.255.255.0

                      On the pfSense firewall I added a new rule.
                      Action: Pass
                      Interface: IPSEC
                      Protocol: Any
                      Source:
                              Type: Network
                              Address: 10.10.10.0/24
                      Destination: LAN subnet

                      Now I am able to see the whole network.
                      This is my first IPSec VPN. That is why I am being so detailed about everything.
                      Thanks for all your help.

                      1 Reply Last reply Reply Quote 0
                      • X
                        XZed
                        last edited by Jul 29, 2009, 7:34 PM

                        well, i arrived on this post after so much discussion but if i well understood :

                        since pfSense 1.2.3, it's (finally) possible to use ipsec vpn clients (shrew-like) to connect to pfsense from anywhere (anywhere = any network with nat….does it mean all  ;D ?) ?

                        a little feedback from experimented users :

                        why do you prefer ipsec to openvpn for mobile clients ? (well, i don't want to open a debate  ;D)

                        Sincerely,

                        1 Reply Last reply Reply Quote 0
                        • J
                          jimp Rebel Alliance Developer Netgate
                          last edited by Jul 29, 2009, 8:30 PM

                          @XZed:

                          why do you prefer ipsec to openvpn for mobile clients ? (well, i don't want to open a debate  ;D)

                          You may want to start a new thread for that question, it won't be seen by as many people when it is buried deep in a thread like this.

                          Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                          Need help fast? Netgate Global Support!

                          Do not Chat/PM for help!

                          1 Reply Last reply Reply Quote 0
                          • X
                            XZed
                            last edited by Jul 30, 2009, 6:24 AM

                            @jimp:

                            You may want to start a new thread for that question, it won't be seen by as many people when it is buried deep in a thread like this.

                            u're right  ;D

                            thanks for the advice  ;)

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                              [[user:consent.lead]]
                              [[user:consent.not_received]]