[2.1] site2site vpn stops to work after Multi VPN server firmware upgrade
-
But there is an error: on site 2. It got the same virtual VPN IP of site 1: 192.168.12.2 (as you can see on my attachment)
That's interesting? Not sure how that is working when two sites have the same virtual IP. Doesn't seem like it should work. Maybe this is the issue with 2.1 Release. I will try to set something up in my lab and let you know the results. Like you said if we can figure out what's going on others can use this as resource for future issues.
-
But there is an error: on site 2. It got the same virtual VPN IP of site 1: 192.168.12.2 (as you can see on my attachment)
That's interesting? Not sure how that is working when two sites have the same virtual IP. Doesn't seem like it should work. Maybe this is the issue with 2.1 Release. I will try to set something up in my lab and let you know the results. Like you said if we can figure out what's going on others can use this as resource for future issues.
I don't know… It has worked flawlessly on 2.01, 2.02, 2.03, 2.1-RC0, 2.1-RC1.
Thank you for your interest.
I hope this can help other pfSense users.. -
[UPDATE]
This afternoon I set a test 2.1-RELEASE pfSense on my mainsite and….As I stated before no difference in routing... (I got some images but they are useless beeing identical to the 2.1-RC1).
Moreover:-
I can ping site1 from inside mainsite pfsensefw
-
I can ping site2 from inside mainsite pfsensefw
Indeed the problem seems to be on multiwan gw.
Disabling failover/loadbal on lan net both vpn start to work.
I found a similar problem here: http://forum.pfsense.org/index.php/topic,68494.0.html -
-
What do your firewall logs show? Where is this traffic getting blocked if at all?
What do the traceroute logs show?
-
Here It's the traceroute…
I did not look to the firewall logs... as I thought no block was on! Tomorrow I'll take a look...
-
This morning I have checked up the fw logs….
No block at all... -
I have no experience with doing a site to site over a MultiWAN setup but I would just make sure that you have 1194 opened up on both interfaces. I would also switch to UDP as TCP could be a source of your problems. Just thinking out loud could there be a problem traffic leaving one WAN interface and then coming back on Anohter? If you disable one of your WAN interfaces does this solve your issues. Is something that is even possible for you to do?
-
No way… at the moment I do not use the 2nd WAN in vpn conf (just internet conn). And the vpn is up and running (=> no fw problem) hence as I stated above disabling just the "multigw" allow vpn to "ping"…
Indeed there is something wrong on routing in 2.1-RELEASE when vpn is coupled with multigw.I don't know if there is something other we can do....
I hope in some admin/developer help...
Pleeeeeeeeeeese! :)Otherwise I (we?) have just to wait 2.1.1...
-
Summarizing I thought It can be only a bug: how is possible routing differently 2 nets with the same gw?
finally… I submit a bug on https://redmine.pfsense.org/issues/3309
I hope this help...
-
[SOLVED]
Fix will be available on 2.1.1