Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Firewall blocking OSPF with VTI's

    Scheduled Pinned Locked Moved FRR
    5 Posts 2 Posters 660 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • srobinsonS
      srobinson
      last edited by

      We are having issues with OSPF on the new VTI interfaces, basically because packets are going in an out different paths the firewall is blocking it, TCP:PA and TCP:A. Has anyone found a way around this? I did turn on Bypass firewall rules for traffic on the same interface but that did not help.

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        What are the actual firewall rules you have in place on the IPsec interface? And what do the full log messages look like?

        I haven't had any trouble hitting OSPF neighbors on VTI nor with TCP. There is probably something else going on with your setup.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • srobinsonS
          srobinson
          last edited by

          Currently there is an allow all rule. I am seeing neighbors just fine and getting the routing tables. It is, for the most part, working. Basically the issue is sometimes packets go out one VTI and come back in another VTI. The firewall doesn't have a state for it and so it seems to block those packets. I know what is happening but I am unsure of how to resolve it.

          Netgate talks about it here but these solutions do not seem to resolve the issue.
          https://www.netgate.com/docs/pfsense/firewall/troubleshooting-blocked-log-entries-due-to-asymmetric-routing.html

          1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by

            Sounds like you have a routing loop or multiple paths with the same cost leading to one. You need to fix your costs so that doesn't happen. That's just an OSPF issue not specific to pfSense.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • srobinsonS
              srobinson
              last edited by

              You were right. There was a configuration error on one of the ospf sites that was causing the asymmetric routing.

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.