Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Please add compression support for ipsec $200

    Scheduled Pinned Locked Moved Expired/Withdrawn Bounties
    17 Posts 2 Posters 11.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E Offline
      Eugene
      last edited by

      How do you test? What methodology would you use to say 'it works'?

      http://ru.doc.pfsense.org

      1 Reply Last reply Reply Quote 0
      • M Offline
        mxx
        last edited by

        when there's a tunnel created that makes use of it :P

        I did only some lousy tests with my existing config which consists of a few Lancom 1811 -> pfsense's racoon. This config works great, but if I just add deflate to the parameters on the Lancom sites, the parties can't negotiate.
        I'm aware that this could be a problem with the Lancom devices, but it's unlikely. As far as I know the setting "compression_algorithm deflate;" in racoon.conf is mandatory.. if a specific tunnel was to be configured for (optional) ipcomp or not, it would have to be set for the SPD.
        I don't think that anything has changed in this domain since my thread a few months ago as I have watched the activity about ipsec changes on redmine… But if it did, I'm sorry to have brought something up which already exists..

        http://forum.pfsense.org/index.php/topic,26517.0.html

        1 Reply Last reply Reply Quote 0
        • E Offline
          Eugene
          last edited by

          Have you tried Jimp's actions?

          –-edited---
          I'd be interested in implementing this but it does not look feasible without being able to test it.

          http://ru.doc.pfsense.org

          1 Reply Last reply Reply Quote 0
          • M Offline
            mxx
            last edited by

            Already replied in the other thread in the 2.0 forum, though wanted to add: PLEASE DO IT ;) and good luck!
            Tried with shrewsoft?

            1 Reply Last reply Reply Quote 0
            • E Offline
              Eugene
              last edited by

              @mxx:

              Tried with shrewsoft?

              Yes, it is successfully negotiate with both ipcomp turned on and off but only if pfSense acts as a server for Mobile Client. I did not manage to make shresoft client to work with pfSense in site-to-site tunnel mode.

              http://ru.doc.pfsense.org

              1 Reply Last reply Reply Quote 0
              • M Offline
                mxx
                last edited by

                Hi,

                this is great news. If you've gotten this far, I'm sure you'll succeed with the remaining site-to-site mode as well ;)

                1 Reply Last reply Reply Quote 0
                • E Offline
                  Eugene
                  last edited by

                  @mxx:

                  Hi,

                  this is great news. If you've gotten this far, I'm sure you'll succeed with the remaining site-to-site mode as well ;)

                  Hi,
                  I am afraid it's not about me, it is about shrewsoft client - it just does not want to negotiate in site-to-site mode and to be honest I do not see how it is expected to work using threwsoft client. You install it on your PC and vpn into the office, that works.
                  As far as I understand you use other software/equipment, why don't we return to your set up?

                  http://ru.doc.pfsense.org

                  1 Reply Last reply Reply Quote 0
                  • M Offline
                    mxx
                    last edited by

                    Hi,

                    thanks for your reply.
                    I'm using several Lancom 1811 VPN gateways to build site-to-site tunnels with a central pfsense box.
                    This of course is a setup you can't test as long as you don't have such a device.

                    Is there no way to verify if a tunnel between 2 pfsense boxes is actually effectively using ipcomp?
                    If that works, it will work with the Lancoms too..

                    1 Reply Last reply Reply Quote 0
                    • M Offline
                      mxx
                      last edited by

                      Or do you have any other hardware vpn gateway which you could use for testing?
                      When I setup ipcomp (using deflate) on the Lancoms, they won't connect if the other side isn't using it.

                      1 Reply Last reply Reply Quote 0
                      • E Offline
                        Eugene
                        last edited by

                        @mxx:

                        Is there no way to verify if a tunnel between 2 pfsense boxes is actually effectively using ipcomp?
                        If that works, it will work with the Lancoms too..

                        I have configuration that allows two pfSense boxes to set up tunnel with ipcomp in SPDs but I do not know a method to prove that ipcomp is actually 'in use' when passing traffic as I do not see any compression.

                        http://ru.doc.pfsense.org

                        1 Reply Last reply Reply Quote 0
                        • E Offline
                          Eugene
                          last edited by

                          @mxx:

                          Or do you have any other hardware vpn gateway which you could use for testing?
                          When I setup ipcomp (using deflate) on the Lancoms, they won't connect if the other side isn't using it.

                          We can try to configure pfSense in the way I did and if it works with Lancoms then we can think about adding this feature to GUI.

                          http://ru.doc.pfsense.org

                          1 Reply Last reply Reply Quote 0
                          • M Offline
                            mxx
                            last edited by

                            Okay, good idea.
                            How would we do this?

                            1 Reply Last reply Reply Quote 0
                            • E Offline
                              Eugene
                              last edited by

                              @mxx:

                              Okay, good idea.
                              How would we do this?

                              Now I am busy at work but I'll pm you later and we'll agree on when and how.

                              http://ru.doc.pfsense.org

                              1 Reply Last reply Reply Quote 0
                              • M Offline
                                mxx
                                last edited by

                                Ok, being busy too, won't be able to do the test until tomorrow

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.