• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

IPSEC tunnels display "connection established" but can not ping peer internal IP

Scheduled Pinned Locked Moved 2.2 Snapshot Feedback and Problems - RETIRED
38 Posts 9 Posters 17.3k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • H
    hoanghaibinh
    last edited by Sep 30, 2014, 1:18 AM Sep 30, 2014, 12:53 AM

    Same to me! Maybe we have to wait for the day pfsense 2.2 release?! :(

    1 Reply Last reply Reply Quote 0
    • P
      pcanada
      last edited by Sep 30, 2014, 2:17 AM

      I am using AES-128 and SHA-1 and I cannot get traffic through any ipsec vpn I create (multiple destinations and target equipment). All indications are that the VPN connection is made and functioning correctly. It seems to me that the issue lies somewhere within the pfSense firewall. Its acting like the firewall is just blocking all IPSec traffic regardless of the firewall entries that tell it to allow.

      1 Reply Last reply Reply Quote 0
      • H
        hoanghaibinh
        last edited by Sep 30, 2014, 2:54 AM

        To my knowledge, when we config vpn connections, the system rules were automatically made to allow traffic of IPSEC protocol go through WAN and we create rules manually to allow traffic bypass IPSEC interface (the IPSEC or OpenVPN interfaces only present after we created ipsec connection). So I suspect the lack of some routing configs in the routing table or some system rules had made this errors.

        1 Reply Last reply Reply Quote 0
        • H
          hege
          last edited by Oct 2, 2014, 6:23 PM Oct 2, 2014, 5:29 PM

          @hoanghaibinh:

          So I suspect the lack of some routing configs in the routing table or some system rules had made this errors.

          IPSec Mobile Client
            Mutual PSK
            Virtual Address Pool: 172.16.94.0/24

          Can someone please check if that route is right? (it doesn't look possible)

          
          Destination 	Gateway 	               Flags 	Use 	 Mtu 	    Netif
          172.16.94.1 	[Primary-GW-IP-of-pfSense] 	UGHS 	0 	1500 	hn0
          
          

          Same config in 2.1.5 but i haven't this route and traffic pass through.

          1 Reply Last reply Reply Quote 0
          • W
            whitewidow
            last edited by Oct 3, 2014, 4:50 PM

            I dont have much to add other than I too have this issue. I show connection on both ends Changing from DES to AES 128 but no traffic passes. Changing from DES to AES makes no difference.

            I will help test in any way if needed just let me know.

            Im on the 10/3 snapshot on ms hyper-v

            1 Reply Last reply Reply Quote 0
            • H
              hoanghaibinh
              last edited by Oct 3, 2014, 6:18 PM Oct 3, 2014, 5:36 PM

              I found this link on google and hope this help since it seems that the description in this case is quite similar in ours:
              https://forums.freebsd.org/viewtopic.php?&t=36125
              I haven't got much time to try this right now but I'll manage to do it soon and let you know the result.

              1 Reply Last reply Reply Quote 0
              • S
                sgw
                last edited by Oct 6, 2014, 4:04 PM

                Thanks for the pointer, unfortunately I am not really able to test that on my systems as I don't really know how to modify the mentioned pf-rules etc

                I compared the output of "netstat -r" (=routes) between the beta and stable 2.1.5 right now.

                I see explicit routes to the IP of the other IPSEC-gateway on 2.1.5 while they are missing on the beta. I have no idea if that matters, it's just what I was thinking of and checking … got to try to add these routes on the beta and re-test pinging (after writing this reply ... ).

                While I let ping run I checked pftop/pfinfo and couldn't spot dropped packages ...

                1 Reply Last reply Reply Quote 0
                • W
                  whitewidow
                  last edited by Oct 7, 2014, 3:23 AM

                  So basically site to site IPsec is broke now correct? Has anyone got it to work yet?

                  1 Reply Last reply Reply Quote 0
                  • E
                    eri--
                    last edited by Oct 7, 2014, 10:02 AM

                    I an unsure why it does not work for some people.

                    For me on first setup it works!

                    1 Reply Last reply Reply Quote 0
                    • S
                      sgw
                      last edited by Oct 7, 2014, 10:06 AM

                      @ermal:

                      I an unsure why it does not work for some people.

                      For me on first setup it works!

                      Maybe it is related to the upgrade-procedure? Maybe the tunnel configs aren't transferred correctly when we upgrade from 2.1.5 to 2.2-beta?

                      1 Reply Last reply Reply Quote 0
                      • C
                        charliem
                        last edited by Oct 7, 2014, 11:35 AM

                        @sgw:

                        Maybe it is related to the upgrade-procedure? Maybe the tunnel configs aren't transferred correctly when we upgrade from 2.1.5 to 2.2-beta?

                        No, I had a clean 2.2 install that was working well (road warrior config, shrewsoft client), then stopped working at some point with a new snapshot.  I believe it stopped working after pfSense updated Strongswan from 5.1.x to 5.2.0, and/or FreeBSD 10.0 to 10.1 prerelease.  Same symptoms as reported here: tunnel is established, but no traffic can pass.

                        @ermal:

                        I an unsure why it does not work for some people.

                        For me on first setup it works!

                        Site-to-site or mobile client?  Can you post a config that works?

                        1 Reply Last reply Reply Quote 0
                        • E
                          eri--
                          last edited by Oct 7, 2014, 5:46 PM

                          Next snapshot should fix the issue.

                          1 Reply Last reply Reply Quote 0
                          • S
                            sgw
                            last edited by Oct 7, 2014, 6:57 PM

                            @ermal:

                            Next snapshot should fix the issue.

                            cool. Can you point us at the bug/commit solving this? I am interested in what the issue was? Thanks!

                            1 Reply Last reply Reply Quote 0
                            • E
                              eri--
                              last edited by Oct 7, 2014, 7:26 PM

                              The issue was in some hashes had wrong size in the kernel due to some improvements done to ipsec.

                              That has been fixed now.

                              1 Reply Last reply Reply Quote 0
                              • H
                                hoanghaibinh
                                last edited by Oct 8, 2014, 12:58 AM

                                Thanks a lot! I upgraded to lastest snapshot . It's working now!

                                1 Reply Last reply Reply Quote 0
                                • S
                                  sgw
                                  last edited by Oct 8, 2014, 4:21 AM

                                  @hoanghaibinh:

                                  Thanks a lot! I upgraded to lastest snapshot . It's working now!

                                  Same here, great!

                                  1 Reply Last reply Reply Quote 0
                                  • F
                                    filnko
                                    last edited by Oct 8, 2014, 9:54 PM

                                    Kinda works for me, although the default gateway get's set to the IPSec connection. (OS X Mavericks)
                                    Can't figure out why as I've only chosen the LAN subnet in phase2 and am running a similar config on 2.1.5 without problems.

                                    Anyone got the same problem?

                                    1 Reply Last reply Reply Quote 0
                                    • H
                                      hoanghaibinh
                                      last edited by Oct 9, 2014, 1:54 AM

                                      @filnko:

                                      although the default gateway get's set to the IPSec connection. (OS X Mavericks)

                                      Can you show your IPSec config more detail? What do you mean "OS X Mavericks" here?

                                      1 Reply Last reply Reply Quote 0
                                      38 out of 38
                                      • First post
                                        38/38
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                        This community forum collects and processes your personal information.
                                        consent.not_received