VPN IPSec - one site has a dynamic ip
-
Hello,
we need a VPN tunnel between our headquarter and a branch office.
On our headquarter site we have a PFSense and in the branch office a lancom vpn router
The PFSense has a static ip adress, the branch office not. We can not use a dyndns.How can i get the VPN IPsec tunnel to work with a dynamic ip?
The VPN Router in the branch office can establish the connection, because in this direction we have a static ip.
Is this enough and what ip should i enter in the P1 remote gateway field on the pfsense? (0.0.0.0)?Thanks for your help.
Best regards,
Steffen -
Why can you not use dynamic DNS?
Try setting the remote gateway on the pfSense side to 0.0.0.0. You will also want to set the pfSense side to responder only since it will never be able to initiate a connection to the other side as it will never know what hostname/IP address to initiate a connection to.
You will need to set the Remote identifier on the pfSense side to match the local identifier on the lancom side. I would use something like type Distinguished Name with a value like lancom.broken.ipsec on each side. This might take some experimenting to find an identifier type that both agree upon and work with. The IPsec logs in Status > System Logs will probably be of help here.
Note that you can only use 0.0.0.0 to connect to one remote site. To connect more you'll need at least DynDNS. Static addresses are, of course, better.
OpenVPN servers can receive connections from arbitrary IP addresses all day every day.
-
@derelict said in VPN IPSec - one site has a dynamic ip:
Why can you not use dynamic DNS?
The lancom's support it
https://www2.lancom.de/kb.nsf/1276/A7D863B0F32A8A39C1257DD400378A2F?OpenDocument
Configuring a dynamic DNS service in LANCOM routers -
Thank you for your answer.
the problem is, that we are not the owner of the internet connection in the branch office. At the moment i dont know if we can use DynDNS for this IP - i have to check this with the IT of the company that owns the internet connection.
I did some tests with the VPN connection and there is one problem. Maybe you can help me with this.
Configuration 1:
Lancom IPSec v1 internal Identifier set to ASN1 Distinguished Name with the Value 10
Lancom IPSec v1 external Identifier set to IPv4 with the value of the static IP Address of the PFSense
PFSense v1 remote Gateway set to 0.0.0.0
PFSense v1 My identifier set to IP address with the value of the static IP Address of the PFSense
PFSense v1 Peer identifier set to ASN.1 Distinguished Name with the Value 10
The Result is: No Connection. The Lancom can not establish the connection and i get the error "ike_phase_1_send_ID: could not get AS.1 ID for <10>"
x509_DN_conf_get: x509_string_DN() failed
x509_string_DN: x509_string XN() failed
x509_string_XN: attribute type without valueConfiguratoin 2:
Lancom IPSec v1 internal Identifier set to IPv4 with the value of the dynamic IP Address of the Lancom
Lancom IPSec v1 external Identifier set to IPv4 with the value of the static IP Address of the PFSense
PFSense v1 remote Gateway set to the dynamic IP Address of the lancom
PFSense v1 My identifier set to IP address with the value of the static IP Address of the PFSense
PFSense v1 Peer identifier set to IP address with the value of the dynamic IP Address of the Lancom
The Result is: Connection establishedConfiguratoin 2:
Lancom IPSec v1 internal Identifier set to IPv4 with the value of the dynamic IP Address of the Lancom
Lancom IPSec v1 external Identifier set to IPv4 with the value of the static IP Address of the PFSense
PFSense v1 remote Gateway set to 0.0.0.0
PFSense v1 My identifier set to IP address with the value of the static IP Address of the PFSense
PFSense v1 Peer identifier set to IP address with the value of the dynamic IP Address of the Lancom
The Result is: No ConnectionThere are two questions.
How should i configure the identifier?
Any Idea how i can get the connection established without the remote gateway ip?Thanks and best regards
-
@kts-tec said in VPN IPSec - one site has a dynamic ip:
that we are not the owner of the internet connection in the branch office.
That doesn't mean anything - all an dyndns does is point a fqdn to the IP... Unless you have the IPs from say ARIN pretty much nobody owns their IPs... Especially home users - and you can point a dyndns name to the IP ;)
Be like saying only lease the car - so can not name it Fred if you wanted too..
-
On the lancom i can set the identifier to mail (fqun).
I dont find a identifier on the pfsense for mail (fqun). Is it possible to use a fqun on the pfsense as identifier?I'm talking about the dyndns with the it department.
-
@kts-tec said in VPN IPSec - one site has a dynamic ip:
On the lancom i can set the identifier to mail (fqun).
I dont find a identifier on the pfsense for mail (fqun). Is it possible to use a fqun on the pfsense as identifier?I'm talking about the dyndns with the it department.
In phase1, select my identifier, or peer identifier, and all options are there.
