Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Mobile IPSec VPN works but does not follow 302 redirects

    Scheduled Pinned Locked Moved IPsec
    ipsec vpn mobilnatfirewall
    26 Posts 3 Posters 4.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by Derelict

      That shows 11.0.0.0 successfully connecting to 192.168.0.98 twice.

      We can't see the actual redirect or URLs being connected to there because it's all wrapped in TLS.

      (What is 11.0.0.0? Are you asking about help with a US Department of Defense VPN?)

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • K
        Konstanti @svarto
        last edited by Konstanti

        @svarto

        Very strange address 11.0.0.0
        What's it?
        so is nat configured ?
        And I see that the connection attempt is repeated twice
        And used tls, it is difficult to understand what the problem is (((((

        1 Reply Last reply Reply Quote 0
        • K
          Konstanti @svarto
          last edited by

          This post is deleted!
          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Looks like TCP is working fine to me. Not sure why that would help.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            K 1 Reply Last reply Reply Quote 0
            • K
              Konstanti @Derelict
              last edited by

              @derelict

              It's just a hypothesis.
              I am very confused by the address 11.0.0.0

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Clicking checkboxes without knowing why is how people get something checked that comes back to bite them later and is almost impossible to find.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                K 1 Reply Last reply Reply Quote 0
                • K
                  Konstanti @Derelict
                  last edited by

                  @derelict

                  This checkbox has already helped a lot of people. It is necessary to see the configuration of the topikstarter to understand whether it can help him or not (often the problem of checksum tcp is faced by the owners of realtek network cards)
                  But I also don't see any problems with tcp in packetcapture file

                  1 Reply Last reply Reply Quote 0
                  • S
                    svarto
                    last edited by svarto

                    @Konstanti @Derelict thanks a lot for looking through this.

                    11.0.0.0 is weird I agree, I just put this as the virtual IP address for client and when I generated an certificate (I followed this guide: https://www.netgate.com/docs/pfsense/vpn/ipsec/configuring-an-ipsec-remote-access-mobile-vpn-using-ikev2-with-eap-mschapv2.html) and connected with my Andriod phone this is the IP that it connects through.

                    0_1549220908822_771da56c-0bb9-4e41-80ca-e0efe369dd20-image.png

                    Perhaps I did a mistake there? To my knowledge, I have not configured any NAT rules for the IPSec VPN server, see below. (Please note, I have my pfsense set up as a OpenVPN client, so there are some NAT rules but that is for a different VPN).
                    0_1549221151947_3c20c74c-c2ef-4cf4-ac3d-1de62db28120-image.png

                    K 1 Reply Last reply Reply Quote 0
                    • K
                      Konstanti @svarto
                      last edited by Konstanti

                      @svarto

                      This is not entirely correct
                      It is better to assign addresses from the allowed list (private ip address)
                      10.0.0.0/8
                      172.16.0.0/12
                      192.168.0.0/16

                      for example, 192.168.30.0/24
                      and then for this network, you can create a NAT outbound rule
                      for example ,
                      ipsec mobile client settings
                      0_1549222354823_154d2798-35f9-409a-8a96-e93c63f3bd33-image.png
                      and
                      nat outbound
                      0_1549222389473_fddb956e-2f21-42fa-853c-8ab9f1942a90-image.png

                      1 Reply Last reply Reply Quote 0
                      • S
                        svarto
                        last edited by

                        This post is deleted!
                        K 1 Reply Last reply Reply Quote 0
                        • K
                          Konstanti @svarto
                          last edited by Konstanti

                          @svarto

                          1. You can open the strongswan app log and see which ip is assigned
                            0_1549223854647_1cbaf250-11fb-4902-9d68-a921119370dd-image.png

                          or
                          2. /status/ipsec/leases

                          or
                          3. Status/System Logs/IPsec

                          0_1549224107316_979c37e0-ce00-4dba-8f49-b18a8fe718f4-image.png

                          1 Reply Last reply Reply Quote 0
                          • S
                            svarto
                            last edited by svarto

                            @Konstanti Thanks man, I managed to reassign the virtual IP and set up the NAT as you mentioned, however it is still not working.

                            0_1549227415987_packetcapture_2.zip

                            I attach a new packet capture. Could it be something with the Unbound DNS Resolver? I am resolving the app1.example.com to IP 192.168.0.98 through pfsense Unbound DNS resolves. It works on all my other devices but is
                            there something special with IPSec VPN Mobile Clients? I read somewhere that I had to set the Outgoing Network Interfaces to LAN and Localhost for it to work over VPN, so did that already.

                            DNS Resolver:
                            0_1549227468379_8de0a228-d7fa-4a4a-96fa-c13413ffd6cd-image.png

                            K 1 Reply Last reply Reply Quote 0
                            • K
                              Konstanti @svarto
                              last edited by

                              @svarto
                              Packetcapture file empty

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                And don't filter on anything but the host address so we can see the DNS queries.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • S
                                  svarto
                                  last edited by

                                  0_1549228302261_PacketCaptureontwointerfaces.zip

                                  @Konstanti @Derelict I created two packetcaptures on the two separate interfaces, filtering for the android IPSec VPN client as Host (i.e. 192.168.200.1)

                                  Should be something in the files now...

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    svarto
                                    last edited by

                                    @Konstanti @Derelict What is very peculiar is that when I am connected to the Wifi on my phone, and then connect through the IPSec VPN. Everything works. When I am not on the internal network but on 4G on my phone, and connect through the IPSec VPN - it doesn't work.

                                    See packetcapture from being on the Wifi and connected through VPN and everything works:
                                    0_1549229309189_IPSecInterfaceonWifiallworks.zip

                                    K 1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      Doesn't do any good to look at pcaps of it working without one of it not working to compare it to.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      S 1 Reply Last reply Reply Quote 0
                                      • K
                                        Konstanti @svarto
                                        last edited by Konstanti

                                        This post is deleted!
                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          svarto @Derelict
                                          last edited by svarto

                                          @derelict said in Mobile IPSec VPN works but does not follow 302 redirects:

                                          Doesn't do any good to look at pcaps of it working without one of it not working to compare it to.

                                          I submitted two packet captures, one where it wasn't working (i.e. Android phone on 4G and the IPSec VPN turned on) and the second where it is working (i.e. Android phone on internal Wifi and the IPSec VPN turned on).

                                          My problem is that I would expect it to work the same whenever I am connected through the IPSec VPN...

                                          Or did I misunderstand your comment?

                                          Please see below:
                                          0_1549260318219_bothpacketcaptures.zip

                                          K 1 Reply Last reply Reply Quote 0
                                          • K
                                            Konstanti @svarto
                                            last edited by

                                            @svarto
                                            Hey
                                            Make two files on the lan interface (ipsec is not necessary)
                                            The first, when works
                                            Second , when not working
                                            What you posted was an ipsec capture (workingpacketcapture.cap)
                                            It looks like this

                                            0_1549261533639_5d9a5085-122d-4b94-b0c5-4555cd33a333-image.png

                                            The second file (Notworkingpacketcapture.cap) you already showed yesterday

                                            0_1549261903833_ef9630b8-e60a-4cda-837b-a8a5a4271481-image.png

                                            This is yesterday's file (LanInterfaceClientasHost.cap)

                                            0_1549261872671_421930b2-149a-4a8d-997b-b3cfebb499b9-image.png

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.