Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSEC Permission? issue…

    Scheduled Pinned Locked Moved IPsec
    16 Posts 6 Posters 5.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • bepoB
      bepo
      last edited by

      Hello Guys,

      anyone solved this problem?

      Apr 10 19:15:47 charon 04[NET] error writing to socket: Permission denied
      Apr 10 19:15:47 charon 08[NET] <con2000|2>sending packet: from 1.2.3.4[500] to 4.3.2.1 [500] (464 bytes)
      Apr 10 19:15:47 charon 08[IKE] <con2000|2>retransmit 2 of request with message ID 0

      The tunnel is working fine for days and dies suddenly without changing something.
      Please help :-)

      Kind regards</con2000|2></con2000|2>

      Please use the thumbs up button if you received a helpful advice. Thank you!

      1 Reply Last reply Reply Quote 0
      • bepoB
        bepo
        last edited by

        Push. No Idea? Its really anoying to have a suddenly crashing tunnel :-(

        Please use the thumbs up button if you received a helpful advice. Thank you!

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Anyone who is having this problem running snort with blocking?

          Probably the endpoint getting blocked for some reason.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          bepoB 1 Reply Last reply Reply Quote 4
          • bepoB
            bepo
            last edited by

            Good Morning,

            thanks for your answer. Actually i am using Snort. I will check the block list next time. Thank you for this idea.

            Kind regards

            Please use the thumbs up button if you received a helpful advice. Thank you!

            1 Reply Last reply Reply Quote 0
            • bepoB
              bepo @Derelict
              last edited by

              @derelict Perfect! Thanks! Snort was blocking the VPN Gateway. I whitelisted SID 122:23. It was triggered everytime i was playing Age of Empires II HD.

              Please use the thumbs up button if you received a helpful advice. Thank you!

              1 Reply Last reply Reply Quote 0
              • M
                moda
                last edited by

                Hello,

                I do have this problem to right now, tunnel has work perfect for months and I havent do any changes.
                I did tried to update to the newest pfsense without success. Tunnel just died after a few hours.
                It always came back up after I reboot firewall. No luck with restart ipsec service.

                I have this in my log.
                Nov 4 08:07:29 charon 04[NET] error writing to socket: Permission denied

                Kind regards

                M 1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Again, look to see if the endpoint is being blocked by snort.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • M
                    moda @moda
                    last edited by

                    I still have problem with one of my tunnels.
                    I have 3 tunnels total and only one is failing with error writing socket. I tried to remake the tunnel on both side and it was the same thing. It work for 2h and then tunnel crash. (site 3)

                    One of the 2 tunnels that is working is between 2 pfsense boxen like this one that is failing and the other one is unifi.
                    on my unifi box the tunnel to site 3 its still working.

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      Are. You. Running. Snort/Suricata?

                      Did. You. Check. Snort/Suricata?

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      M 1 Reply Last reply Reply Quote 0
                      • M
                        moda @Derelict
                        last edited by

                        @derelict Hi thanks for answer. No I do not run anything that isnt in standard configuration for pfsense. I only installed it and configure my 2 network card and then 3 ipsec tunnels.

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          Well, permission denied there is IPsec being forced out of that interface to or from an address that is denied by policy. So I would have a good look at all of your firewall rules for that source or destination. If you have changed from permission denied to some other problem, you need to make that more clear and probably start a new thread. In fact, since you are talking about a completely new problem (since you are not running IDS/IPS) I'd just start a new thread with details specific to your problem.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • M
                            moda
                            last edited by

                            @derelict but I havent changed anything with my policy and if I reboot my firewall all 3 tunnels come up with without any problem. And then my third tunnel suddenly die. All my 3 tunnels go out on same interface (WAN).

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              Start your own thread.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.