Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSEC tunnels display "connection established" but can not ping peer internal IP

    Scheduled Pinned Locked Moved 2.2 Snapshot Feedback and Problems - RETIRED
    38 Posts 9 Posters 17.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      hoanghaibinh
      last edited by

      I found this link on google and hope this help since it seems that the description in this case is quite similar in ours:
      https://forums.freebsd.org/viewtopic.php?&t=36125
      I haven't got much time to try this right now but I'll manage to do it soon and let you know the result.

      1 Reply Last reply Reply Quote 0
      • S
        sgw
        last edited by

        Thanks for the pointer, unfortunately I am not really able to test that on my systems as I don't really know how to modify the mentioned pf-rules etc

        I compared the output of "netstat -r" (=routes) between the beta and stable 2.1.5 right now.

        I see explicit routes to the IP of the other IPSEC-gateway on 2.1.5 while they are missing on the beta. I have no idea if that matters, it's just what I was thinking of and checking … got to try to add these routes on the beta and re-test pinging (after writing this reply ... ).

        While I let ping run I checked pftop/pfinfo and couldn't spot dropped packages ...

        1 Reply Last reply Reply Quote 0
        • W
          whitewidow
          last edited by

          So basically site to site IPsec is broke now correct? Has anyone got it to work yet?

          1 Reply Last reply Reply Quote 0
          • E
            eri--
            last edited by

            I an unsure why it does not work for some people.

            For me on first setup it works!

            1 Reply Last reply Reply Quote 0
            • S
              sgw
              last edited by

              @ermal:

              I an unsure why it does not work for some people.

              For me on first setup it works!

              Maybe it is related to the upgrade-procedure? Maybe the tunnel configs aren't transferred correctly when we upgrade from 2.1.5 to 2.2-beta?

              1 Reply Last reply Reply Quote 0
              • C
                charliem
                last edited by

                @sgw:

                Maybe it is related to the upgrade-procedure? Maybe the tunnel configs aren't transferred correctly when we upgrade from 2.1.5 to 2.2-beta?

                No, I had a clean 2.2 install that was working well (road warrior config, shrewsoft client), then stopped working at some point with a new snapshot.  I believe it stopped working after pfSense updated Strongswan from 5.1.x to 5.2.0, and/or FreeBSD 10.0 to 10.1 prerelease.  Same symptoms as reported here: tunnel is established, but no traffic can pass.

                @ermal:

                I an unsure why it does not work for some people.

                For me on first setup it works!

                Site-to-site or mobile client?  Can you post a config that works?

                1 Reply Last reply Reply Quote 0
                • E
                  eri--
                  last edited by

                  Next snapshot should fix the issue.

                  1 Reply Last reply Reply Quote 0
                  • S
                    sgw
                    last edited by

                    @ermal:

                    Next snapshot should fix the issue.

                    cool. Can you point us at the bug/commit solving this? I am interested in what the issue was? Thanks!

                    1 Reply Last reply Reply Quote 0
                    • E
                      eri--
                      last edited by

                      The issue was in some hashes had wrong size in the kernel due to some improvements done to ipsec.

                      That has been fixed now.

                      1 Reply Last reply Reply Quote 0
                      • H
                        hoanghaibinh
                        last edited by

                        Thanks a lot! I upgraded to lastest snapshot . It's working now!

                        1 Reply Last reply Reply Quote 0
                        • S
                          sgw
                          last edited by

                          @hoanghaibinh:

                          Thanks a lot! I upgraded to lastest snapshot . It's working now!

                          Same here, great!

                          1 Reply Last reply Reply Quote 0
                          • F
                            filnko
                            last edited by

                            Kinda works for me, although the default gateway get's set to the IPSec connection. (OS X Mavericks)
                            Can't figure out why as I've only chosen the LAN subnet in phase2 and am running a similar config on 2.1.5 without problems.

                            Anyone got the same problem?

                            1 Reply Last reply Reply Quote 0
                            • H
                              hoanghaibinh
                              last edited by

                              @filnko:

                              although the default gateway get's set to the IPSec connection. (OS X Mavericks)

                              Can you show your IPSec config more detail? What do you mean "OS X Mavericks" here?

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.