IPSEC tunnels display "connection established" but can not ping peer internal IP

hoanghaibinh · Oct 3, 2014, 6:18 PM

I found this link on google and hope this help since it seems that the description in this case is quite similar in ours:
https://forums.freebsd.org/viewtopic.php?&t=36125
I haven't got much time to try this right now but I'll manage to do it soon and let you know the result.

sgw · Oct 6, 2014, 4:04 PM

Thanks for the pointer, unfortunately I am not really able to test that on my systems as I don't really know how to modify the mentioned pf-rules etc

I compared the output of "netstat -r" (=routes) between the beta and stable 2.1.5 right now.

I see explicit routes to the IP of the other IPSEC-gateway on 2.1.5 while they are missing on the beta. I have no idea if that matters, it's just what I was thinking of and checking … got to try to add these routes on the beta and re-test pinging (after writing this reply ... ).

While I let ping run I checked pftop/pfinfo and couldn't spot dropped packages ...

whitewidow · Oct 7, 2014, 3:23 AM

So basically site to site IPsec is broke now correct? Has anyone got it to work yet?

eri-- · Oct 7, 2014, 10:02 AM

I an unsure why it does not work for some people.

For me on first setup it works!

sgw · Oct 7, 2014, 10:06 AM

@ermal:

I an unsure why it does not work for some people.

For me on first setup it works!

Maybe it is related to the upgrade-procedure? Maybe the tunnel configs aren't transferred correctly when we upgrade from 2.1.5 to 2.2-beta?

charliem · Oct 7, 2014, 11:35 AM

@sgw:

Maybe it is related to the upgrade-procedure? Maybe the tunnel configs aren't transferred correctly when we upgrade from 2.1.5 to 2.2-beta?

No, I had a clean 2.2 install that was working well (road warrior config, shrewsoft client), then stopped working at some point with a new snapshot. I believe it stopped working after pfSense updated Strongswan from 5.1.x to 5.2.0, and/or FreeBSD 10.0 to 10.1 prerelease. Same symptoms as reported here: tunnel is established, but no traffic can pass.

@ermal:

I an unsure why it does not work for some people.

For me on first setup it works!

Site-to-site or mobile client? Can you post a config that works?

eri-- · Oct 7, 2014, 5:46 PM

Next snapshot should fix the issue.

sgw · Oct 7, 2014, 6:57 PM

@ermal:

Next snapshot should fix the issue.

cool. Can you point us at the bug/commit solving this? I am interested in what the issue was? Thanks!

eri-- · Oct 7, 2014, 7:26 PM

The issue was in some hashes had wrong size in the kernel due to some improvements done to ipsec.

That has been fixed now.

hoanghaibinh · Oct 8, 2014, 12:58 AM

Thanks a lot! I upgraded to lastest snapshot . It's working now!

sgw · Oct 8, 2014, 4:21 AM

@hoanghaibinh:

Thanks a lot! I upgraded to lastest snapshot . It's working now!

Same here, great!

filnko · Oct 8, 2014, 9:54 PM

Kinda works for me, although the default gateway get's set to the IPSec connection. (OS X Mavericks)
Can't figure out why as I've only chosen the LAN subnet in phase2 and am running a similar config on 2.1.5 without problems.

Anyone got the same problem?

hoanghaibinh · Oct 9, 2014, 1:54 AM

@filnko:

although the default gateway get's set to the IPSec connection. (OS X Mavericks)

Can you show your IPSec config more detail? What do you mean "OS X Mavericks" here?