IPsec LAN to LAN tunnel not working without corresponding firewall rules?
-
Dear forum,
I managed to get a IPsec tunnel between two pfsense machines up and connected (SAD and SPD established). But I did not get any pings/packets going until I added a corresponding firewall rule (ICMP/TCP) on the ipsec interfaces on each pfsense machine to let the traffic pass from one lan to the other lan. Is it supposed to be done this way? I thought to remember to have read somewhere (the book) that the IPsec connection adds an according firewall rule itself, kinda like the NAT port-forwarding.
Thanks Stefan
-
The automatic rule lets the actual IPsec traffic in on the WAN so the tunnel will come up.
You need to add the rules on the IPsec tab to pass the traffic you want inside the tunnel.
-
Okay, as I thought…
-
Yea totally agree. I remember when i thought that when i first intalled Pfsense.
