IPSec VPN Failover to another router (on LAN)

fthomasr

I have a VPN tunnel (pfSense 2.0 to another 2.0) that routes all traffic 0.0.0.0/24 through the tunnel. However when the tunnel goes down I need the traffic to automatically route to another gateway on the LAN. This gateway is already defined in the pfSense box(as the default gateway) and it WILL route traffic there only IF you disable the tunnel, not when the tunnel is down.

Is there a way to have it automatically failover to the old slow circuit?

Metu69salemi

search forum with failover wan.. and you should your answer. just improvice if it doesn't have the spot on answer

fthomasr

I searched for failover WAN and read the book. There is nothing I could find like this. Everything I found expects two WAN ports.

jimp

That isn't possible with IPsec in that way. You would need to either use OpenVPN or IPsec in transport mode + a GIF tunnel, and run a dynamic routing protocol on top like OSPF

IPsec in tunnel mode will grab the traffic and isn't capable of doing failover like that.

Even if you managed to get the client side to send traffic the other way, unless you do NAT on the way out, the return traffic from the other side would only take the way back that followed its routing table in most cases.

Something like OSPF would let it automatically select whichever route was up/preferred.

fthomasr

Ok, I thought that IPSec might be a roadblock, so we've been trying to setup OpenVPN to do it.

Are you saying that OpenVPN alone? In other words without the use of OSPF?

Thanks

marcelloc

Take a look at this topic, it's used to enable IPSec when wan fails, but you can change it to work the way you need.
http://forum.pfsense.org/index.php/topic,42025.0.html