Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSEC Permission? issue…

    Scheduled Pinned Locked Moved IPsec
    16 Posts 6 Posters 5.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • bepoB
      bepo
      last edited by

      Good Morning,

      thanks for your answer. Actually i am using Snort. I will check the block list next time. Thank you for this idea.

      Kind regards

      Please use the thumbs up button if you received a helpful advice. Thank you!

      1 Reply Last reply Reply Quote 0
      • bepoB
        bepo @Derelict
        last edited by

        @derelict Perfect! Thanks! Snort was blocking the VPN Gateway. I whitelisted SID 122:23. It was triggered everytime i was playing Age of Empires II HD.

        Please use the thumbs up button if you received a helpful advice. Thank you!

        1 Reply Last reply Reply Quote 0
        • M
          moda
          last edited by

          Hello,

          I do have this problem to right now, tunnel has work perfect for months and I havent do any changes.
          I did tried to update to the newest pfsense without success. Tunnel just died after a few hours.
          It always came back up after I reboot firewall. No luck with restart ipsec service.

          I have this in my log.
          Nov 4 08:07:29 charon 04[NET] error writing to socket: Permission denied

          Kind regards

          M 1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Again, look to see if the endpoint is being blocked by snort.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • M
              moda @moda
              last edited by

              I still have problem with one of my tunnels.
              I have 3 tunnels total and only one is failing with error writing socket. I tried to remake the tunnel on both side and it was the same thing. It work for 2h and then tunnel crash. (site 3)

              One of the 2 tunnels that is working is between 2 pfsense boxen like this one that is failing and the other one is unifi.
              on my unifi box the tunnel to site 3 its still working.

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Are. You. Running. Snort/Suricata?

                Did. You. Check. Snort/Suricata?

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                M 1 Reply Last reply Reply Quote 0
                • M
                  moda @Derelict
                  last edited by

                  @derelict Hi thanks for answer. No I do not run anything that isnt in standard configuration for pfsense. I only installed it and configure my 2 network card and then 3 ipsec tunnels.

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Well, permission denied there is IPsec being forced out of that interface to or from an address that is denied by policy. So I would have a good look at all of your firewall rules for that source or destination. If you have changed from permission denied to some other problem, you need to make that more clear and probably start a new thread. In fact, since you are talking about a completely new problem (since you are not running IDS/IPS) I'd just start a new thread with details specific to your problem.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • M
                      moda
                      last edited by

                      @derelict but I havent changed anything with my policy and if I reboot my firewall all 3 tunnels come up with without any problem. And then my third tunnel suddenly die. All my 3 tunnels go out on same interface (WAN).

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Start your own thread.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.