Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSEC Permission? issue…

    Scheduled Pinned Locked Moved IPsec
    16 Posts 6 Posters 5.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • bepoB
      bepo
      last edited by

      Push. No Idea? Its really anoying to have a suddenly crashing tunnel :-(

      Please use the thumbs up button if you received a helpful advice. Thank you!

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Anyone who is having this problem running snort with blocking?

        Probably the endpoint getting blocked for some reason.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        bepoB 1 Reply Last reply Reply Quote 4
        • bepoB
          bepo
          last edited by

          Good Morning,

          thanks for your answer. Actually i am using Snort. I will check the block list next time. Thank you for this idea.

          Kind regards

          Please use the thumbs up button if you received a helpful advice. Thank you!

          1 Reply Last reply Reply Quote 0
          • bepoB
            bepo @Derelict
            last edited by

            @derelict Perfect! Thanks! Snort was blocking the VPN Gateway. I whitelisted SID 122:23. It was triggered everytime i was playing Age of Empires II HD.

            Please use the thumbs up button if you received a helpful advice. Thank you!

            1 Reply Last reply Reply Quote 0
            • M
              moda
              last edited by

              Hello,

              I do have this problem to right now, tunnel has work perfect for months and I havent do any changes.
              I did tried to update to the newest pfsense without success. Tunnel just died after a few hours.
              It always came back up after I reboot firewall. No luck with restart ipsec service.

              I have this in my log.
              Nov 4 08:07:29 charon 04[NET] error writing to socket: Permission denied

              Kind regards

              M 1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Again, look to see if the endpoint is being blocked by snort.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • M
                  moda @moda
                  last edited by

                  I still have problem with one of my tunnels.
                  I have 3 tunnels total and only one is failing with error writing socket. I tried to remake the tunnel on both side and it was the same thing. It work for 2h and then tunnel crash. (site 3)

                  One of the 2 tunnels that is working is between 2 pfsense boxen like this one that is failing and the other one is unifi.
                  on my unifi box the tunnel to site 3 its still working.

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Are. You. Running. Snort/Suricata?

                    Did. You. Check. Snort/Suricata?

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    M 1 Reply Last reply Reply Quote 0
                    • M
                      moda @Derelict
                      last edited by

                      @derelict Hi thanks for answer. No I do not run anything that isnt in standard configuration for pfsense. I only installed it and configure my 2 network card and then 3 ipsec tunnels.

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Well, permission denied there is IPsec being forced out of that interface to or from an address that is denied by policy. So I would have a good look at all of your firewall rules for that source or destination. If you have changed from permission denied to some other problem, you need to make that more clear and probably start a new thread. In fact, since you are talking about a completely new problem (since you are not running IDS/IPS) I'd just start a new thread with details specific to your problem.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • M
                          moda
                          last edited by

                          @derelict but I havent changed anything with my policy and if I reboot my firewall all 3 tunnels come up with without any problem. And then my third tunnel suddenly die. All my 3 tunnels go out on same interface (WAN).

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            Start your own thread.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.