Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Access printer from foreign network over IPSEC (multiple locations)

    Scheduled Pinned Locked Moved IPsec
    36 Posts 3 Posters 2.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      conor
      last edited by

      yes

      200+ pfSense installs - best firewall ever.

      B 1 Reply Last reply Reply Quote 0
      • B
        bashuis @conor
        last edited by bashuis

        @conor
        OK, i created the P2.
        it is not UP, but that could be because there is no traffic going over it..

        several other P2's over the samen P1 are online..

        location 1 (pfsense01):
        9cd3ddc1-5860-4644-bf3b-aaab6e7fb812-image.png

        location 2 (pfsense02):
        502d36c4-e9aa-4b60-966a-6509a2f1c8ed-image.png

        Should i disconnect and reconnect the whole IPSEC connection?

        C 1 Reply Last reply Reply Quote 0
        • C
          conor
          last edited by

          on pfsense 02 for the sake of testing goto Firewall > Rules > IPSEC
          add an allow all rule for this interface, you can fine tune it later this is just for testing

          200+ pfSense installs - best firewall ever.

          1 Reply Last reply Reply Quote 0
          • C
            conor @bashuis
            last edited by

            @bashuis said in Access printer from foreign network over IPSEC (multiple locations):

            Should i disconnect and reconnect the whole IPSEC connection?

            if the down time isn't going to bother you probably best.

            200+ pfSense installs - best firewall ever.

            B 1 Reply Last reply Reply Quote 0
            • B
              bashuis
              last edited by

              @conor said in Access printer from foreign network over IPSEC (multiple locations):

              sake of testing goto Firewall > Rules > IPSEC
              add an allow all rule for this interface, you can fine tune it later this is just for testing

              this rule was already active (for testing) on the IPSEC interface
              fd807ff2-c41f-4782-8667-35d7543bad38-image.png

              1 Reply Last reply Reply Quote 0
              • C
                conor
                last edited by

                send a ping from the 172 network to the the printer ip in the 192 network, I'm half expecting this to fail, if it does check that you can still ping the 10.130.76.136 ip address.

                200+ pfSense installs - best firewall ever.

                B 1 Reply Last reply Reply Quote 0
                • B
                  bashuis @conor
                  last edited by

                  @conor said in Access printer from foreign network over IPSEC (multiple locations):

                  @bashuis said in Access printer from foreign network over IPSEC (multiple locations):

                  Should i disconnect and reconnect the whole IPSEC connection?

                  if the down time isn't going to bother you probably best.

                  @conor
                  that is not possible now, people are working over the other P2's

                  if it is needed i can shedule this later today/tonight

                  1 Reply Last reply Reply Quote 0
                  • B
                    bashuis @conor
                    last edited by bashuis

                    @conor said in Access printer from foreign network over IPSEC (multiple locations):

                    send a ping from the 172 network to the the printer ip in the 192 network, I'm half expecting this to fail, if it does check that you can still ping the 10.130.76.136 ip address.

                    that is an problem, i have no access to the 172 network.

                    they started an permanent ping to 10.130.76.136 that i can use to debug.

                    i think we should NAT? 10.130.76.136 to 192.168.41.15

                    packet capturing on LAN2 (pfsense01) give now:
                    11:52:17.648234 IP 172.16.0.26 > 10.130.76.136: ICMP echo request, id 250, seq 37518, length 36
                    11:52:17.648254 IP 10.130.76.132 > 172.16.0.26: ICMP time exceeded in-transit, length 36

                    C 2 Replies Last reply Reply Quote 0
                    • C
                      conor @bashuis
                      last edited by

                      @bashuis
                      correct, the customer router doesn't understand where the 192 is located, so a NAT is now needed, just enable the ICMP NAT first for testing.

                      200+ pfSense installs - best firewall ever.

                      1 Reply Last reply Reply Quote 0
                      • C
                        conor @bashuis
                        last edited by

                        @bashuis said in Access printer from foreign network over IPSEC (multiple locations):

                        packet capturing on LAN2 (pfsense01) give now:
                        11:52:17.648234 IP 172.16.0.26 > 10.130.76.136: ICMP echo request, id 250, seq 37518, length 36
                        11:52:17.648254 IP 10.130.76.132 > 172.16.0.26: ICMP time exceeded in-transit, length 36

                        is that with the NAT?

                        200+ pfSense installs - best firewall ever.

                        B 1 Reply Last reply Reply Quote 0
                        • B
                          bashuis @conor
                          last edited by

                          @conor said in Access printer from foreign network over IPSEC (multiple locations):

                          @bashuis said in Access printer from foreign network over IPSEC (multiple locations):

                          packet capturing on LAN2 (pfsense01) give now:
                          11:52:17.648234 IP 172.16.0.26 > 10.130.76.136: ICMP echo request, id 250, seq 37518, length 36
                          11:52:17.648254 IP 10.130.76.132 > 172.16.0.26: ICMP time exceeded in-transit, length 36

                          is that with the NAT?

                          no before.

                          i added this NAT rule on interface LAN2 on pfsense01
                          e99adb90-ed5b-409f-8910-77ae24e04b24-image.png

                          now i see the same:
                          11:54:49.664412 IP 172.16.0.26 > 10.130.76.136: ICMP echo request, id 250, seq 41040, length 36
                          11:54:49.664433 IP 10.130.76.132 > 172.16.0.26: ICMP time exceeded in-transit, length 36

                          C 1 Reply Last reply Reply Quote 0
                          • C
                            conor @bashuis
                            last edited by

                            @bashuis
                            If the ping is failing before you add the NAT there still is the problem of pfsense01 to 172 to resolve, remove the NAT rule until that is resolved.

                            200+ pfSense installs - best firewall ever.

                            1 Reply Last reply Reply Quote 0
                            • C
                              conor
                              last edited by

                              can you send me the Routes for the pfsense01 please, Diagnostics > Routes

                              200+ pfSense installs - best firewall ever.

                              B 1 Reply Last reply Reply Quote 0
                              • B
                                bashuis @conor
                                last edited by bashuis

                                @conor said in Access printer from foreign network over IPSEC (multiple locations):

                                can you send me the Routes for the pfsense01 please, Diagnostics > Routes

                                b625543a-6454-4299-91f5-2538addd662d-image.png

                                i see i have made an mistake in the ip's from the custommerrouter and LAN2 (switched, same lan). this is correct:
                                voorbeeld.jpg
                                also added the new P2

                                we could also have a look with teamviewer/telephone if you like?

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.