Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSec established, no Traffic passing.

    Scheduled Pinned Locked Moved 2.0-RC Snapshot Feedback and Problems - RETIRED
    40 Posts 6 Posters 48.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      eazydor
      last edited by

      It seems that the Client doesn´t receive a IP from pfSense, since the connection is shown up under Status/Overview, SAD&SPD are set, but the remote IP-field stays empty.
      The Client however says, he received an IP from the given Pool..

      I´ve tried different Clients (OSX-Cisco-IPSec; Shrewsoft VPN, IPSecuritas, etc..)..
      I did tried to some hint´s out of related topics, changing sysctl´s, changing mtu, …

      Is this mal-configuration by me or a bug in the beta?

      ??? ::) ???

      Thankful for any advice..

      Sydney

      1 Reply Last reply Reply Quote 0
      • C
        cmb
        last edited by

        mobile IPsec doesn't work at the moment.

        1 Reply Last reply Reply Quote 0
        • E
          eazydor
          last edited by

          OK, thanks cmb..

          Is it a routing or filtering problem then?
          Nothing i can do about it?

          1 Reply Last reply Reply Quote 0
          • A
            azzido
            last edited by

            Most likely it's an ipsec tools issue. See this thread for more details http://forum.pfsense.org/index.php/topic,23519.0.html

            1 Reply Last reply Reply Quote 0
            • H
              horsedragon
              last edited by

              anyone try the newer snap-version, the newer version can work fine? thank U!

              1 Reply Last reply Reply Quote 0
              • A
                azzido
                last edited by

                I tried May 14th snapshot and was able to successfully establish pure IPSec VPN connection between iPhone and pfSense and access internal network. Thanks for fixing it guys

                1 Reply Last reply Reply Quote 0
                • E
                  eazydor
                  last edited by

                  hey azzido, with which settings?!?

                  1 Reply Last reply Reply Quote 0
                  • jimpJ
                    jimp Rebel Alliance Developer Netgate
                    last edited by

                    If you setup a site-to-site type tunnel, IPsec work. If you setup a mobile style tunnel, it does not work. I confirmed this again last week, but I was on the May 12th snapshot. I should update and try it again today.

                    I'm not sure what azzido did, but I'd also be interesting in knowing what method was used.

                    I know how to make it work by hand after the connection is established, but it is completely impractical and only useful for verifying tests. (See my post on the ipsec-tools-devel list here: http://sourceforge.net/mailarchive/message.php?msg_name=4BEDB60C.2080501%40pingle.org )

                    Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                    Need help fast? Netgate Global Support!

                    Do not Chat/PM for help!

                    1 Reply Last reply Reply Quote 0
                    • jimpJ
                      jimp Rebel Alliance Developer Netgate
                      last edited by

                      I just tried a mobile tunnel again on today's snapshot and I still can't pass traffic when it connects.

                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                      Need help fast? Netgate Global Support!

                      Do not Chat/PM for help!

                      1 Reply Last reply Reply Quote 0
                      • E
                        eazydor
                        last edited by

                        after all, what was/is the problem with roadwarrior support?
                        wrong security policies (SPD's)?!?
                        I'm would love to know, how azzido got it working, with or without little snitches..

                        1 Reply Last reply Reply Quote 0
                        • jimpJ
                          jimp Rebel Alliance Developer Netgate
                          last edited by

                          When the mobile client connects, it makes SPDs but doesn't properly tie them to the tunnel somehow.

                          Flushing the SPDs and adding them back by hand makes it work - though the output of setkey before and after appears identical.

                          Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                          Need help fast? Netgate Global Support!

                          Do not Chat/PM for help!

                          1 Reply Last reply Reply Quote 0
                          • A
                            azzido
                            last edited by

                            I will post my setup once I get back home. It's basically the same setup that I posted in my previous thread that was not working before. Typing this while on the bus connected via VPN :)

                            1 Reply Last reply Reply Quote 0
                            • E
                              eazydor
                              last edited by

                              no way, man. congrats to the first benefits of your first class tunnel…

                              but you didn't had to flush & re-add the policies by hand? (i guess not, in a bus...)
                              i tried with the same config you've posted in another thread, iphone& ipsec i guess, on a 14May/22:45-i386-livecd-snapshot, but without luck..

                              would be great if you could help..

                              1 Reply Last reply Reply Quote 0
                              • A
                                azzido
                                last edited by

                                No, didn't have to do anything fancy this time. It just works. And SPDs are auto generated. The only problem is if iPhone disconnects from 3g it does not automatically re-establish VPN tunnel so you have to connect manually. I think there is a way to force iPhone to automatically establish tunnel when you try to access certain sites.

                                1 Reply Last reply Reply Quote 0
                                • E
                                  eazydor
                                  last edited by

                                  i dont get it. how could this be possible.. you're sure that traffic is passing through the tunnel?
                                  jimp couldn't get it to work too, at least without flushing spd's..

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    azzido
                                    last edited by

                                    Yep, works like a charm actually. I just need Internet connection with faster uplink now

                                    1 Reply Last reply Reply Quote 0
                                    • E
                                      eazydor
                                      last edited by

                                      you've separated the ipsec-net from the lan-net this time (ip range)?
                                      386 or amd64?
                                      nano or live?
                                      tell us, make us wise, my friend..

                                      what about your network setting's, did you add a new gateway?

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        azzido
                                        last edited by

                                        This is IPsec setup on pfSense:

                                        VPN -> IPsec -> Mobile clients

                                        IKE Extensions
                                                Enable IPsec Mobile Client Support                      yes
                                            Extended Authentication (Xauth)
                                                User Authentication                                      system
                                                Group Authentication                                    system
                                            Client Configuration (mode-cfg)
                                                Virtual Address Pool
                                                    Provide a vitual IP address to clients              yes
                                                    Network                                              192.168.103.0 / 24              !!! use subnet that is not currently used
                                                Network List
                                                    Provide a list of accessible networks to clients    no
                                                DNS Default Domain
                                                    Provide a default domain name to clients            yes
                                                    Domain                                              domain.lan                      !!! can be same as pfSense domain
                                                DNS Servers
                                                    Provide a DNS server list to clients                yes
                                                    DNS Servers                                          208.67.222.222                  !!! openDNS
                                                WINS Servers
                                                    Provide a WINS server list to clients                no
                                                Phase2 PFS Group
                                                    Provide the Phase2 PFS group to clients              no
                                                Login Banner
                                                    Provide a login banner to clients                    no

                                        VPN -> IPsec > Tunnels

                                        Enable IPsec                                                yes

                                        VPN -> IPsec -> Tunnels -> Phase 1

                                        General information
                                                Interface                                                WAN
                                                Description                                              iPhone
                                            Phase 1 proposal (Authentication)
                                                Authentication method                                    Mutual PSK + Xauth
                                                Negotiation mode                                        aggressive                      !!! as per iPhone documentation
                                                My identifier                                            My IP address
                                                Peer identifier                                          Distinguished name              !!! enter name of the group
                                                Pre-Shared Key                                          *                                !!! 63 random alpha-numeric characters (a-z, A-Z, 0-9) from https://www.grc.com/passwords.htm
                                                Encryption algorithm                                    AES / 256 bits                   !!! that's the first thing iPhone proposes so that's what we use
                                                Hash algorithm                                          SHA1                            !!! that's the first thing iPhone proposes so that's what we use
                                                DH key group                                            2                                !!! as per iPhone documentation
                                                Lifetime                                                28800                            !!! leave default
                                            Advanced Options
                                                NAT Traversal                                            Enable
                                                Dead Peer Detection
                                                    Enable DPD                                          yes
                                                    Delay between requesting peer acknowledgement.      10
                                                    No of consecutive failures allowed before disconnect 5

                                        VPN -> IPsec -> Tunnels -> Phase 2

                                        Mode                                                        Tunnel
                                            Local Network
                                                Type                                                    none
                                                Address                                                  leave blank
                                            Phase 2 proposal (SA/Key Exchange)
                                                Protocol                                                ESP
                                                Encryption algorithms                                    AES / 256 bits
                                                Hash algorithms                                          SHA1
                                                PFS key group                                            off
                                                Lifetime                                                3600
                                            Advanced Options
                                                Automatically ping host                                  -

                                        and here is iPhone setup:

                                        Settings -> General -> Network -> VPN -> Add VPN Configuration -> IPSec

                                        Description                              descriptive name
                                        Server                                    domain name or IP address of pfSense WAN interface
                                        Account                                  user name (on pfSense box)
                                        Password                                  user password
                                        Use Certificate                          off
                                        Group Name                                Peer identifier from pfSense setup
                                        Secret                                    Pre-Shared Key from pfSense setup

                                        • User that you specify in iPhone needs to be created on pfSense under System -> User Manager

                                        • If you use Alix board disable glxsb under System -> Advanced -> Miscellaneous

                                        • Firewall needs to allow incoming UDP connections from WAN on ports 500 and 4500

                                        • Firewall needs to allow IPSec traffic; create allow all rule with loggin while testing

                                        Try this and post your /var/etc/racoon.conf in case it does not work.

                                        Good luck

                                        1 Reply Last reply Reply Quote 0
                                        • E
                                          eazydor
                                          last edited by

                                          awesome, thanks..
                                          i give it a try right now..

                                          1 Reply Last reply Reply Quote 0
                                          • jimpJ
                                            jimp Rebel Alliance Developer Netgate
                                            last edited by

                                            Are you using that script mentioned in the other thread that flushes the keys? If so, it's just doing what I did by hand, automatically. And it's not a long-term solution for anyone using IPsec for other uses as well as mobile clients.

                                            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                            Need help fast? Netgate Global Support!

                                            Do not Chat/PM for help!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.