Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Setting up IPsec VPN pfsense to dsr dlink-1000 router

    Scheduled Pinned Locked Moved IPsec
    32 Posts 5 Posters 3.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • perikoP
      periko
      last edited by

      Does your Dlink support IPSec v2?

      Necesitan Soporte de Pfsense en México?/Need Pfsense Support in Mexico?
      www.bajaopensolutions.com
      https://www.facebook.com/BajaOpenSolutions
      Quieres aprender PfSense, visita mi canal de youtube:
      https://www.youtube.com/c/PedroMorenoBOS

      1 Reply Last reply Reply Quote 1
      • G
        Gap
        last edited by

        Hi periko thanks what do you mean IPSEC v2? the IKE v2? if thats what you mean its a yes my dlink supports IPSec v2.

        It appears that I already found my mistake. I saw that my DLINK PFS cant handle DH 15 my only options are DH 1, 2, and 5. On phase 2.

        1 Reply Last reply Reply Quote 1
        • G
          Gap
          last edited by

          Just adding this system logs on my pfsense please help. my problem still not fixed.

          Jul 24 11:19:00 charon 05[JOB] <80> deleting half open IKE_SA with 125.5.78.227 after timeout
          Jul 24 11:19:00 charon 05[IKE] <80> IKE_SA (unnamed)[80] state change: CONNECTING => DESTROYING
          Jul 24 11:19:02 charon 14[CFG] vici client 1118 connected
          Jul 24 11:19:02 charon 14[CFG] vici client 1118 registered for: list-sa
          Jul 24 11:19:02 charon 14[CFG] vici client 1118 requests: list-sas
          Jul 24 11:19:02 charon 05[CFG] vici client 1118 disconnected
          Jul 24 11:19:03 charon 11[NET] <82> received packet: from 125.5.78.227[500] to 125.5.78.228[500] (432 bytes)
          Jul 24 11:19:03 charon 11[ENC] <82> parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_D_IP) N(NATD_S_IP) V V V V ]
          Jul 24 11:19:03 charon 11[CFG] <82> looking for an IKEv2 config for 125.5.78.228...125.5.78.227
          Jul 24 11:19:03 charon 11[CFG] <82> candidate: %any...%any, prio 24
          Jul 24 11:19:03 charon 11[CFG] <82> candidate: 125.5.78.228...125.5.78.227, prio 3096
          Jul 24 11:19:03 charon 11[CFG] <82> found matching ike config: 125.5.78.228...125.5.78.227 with prio 3096
          Jul 24 11:19:03 charon 11[ENC] <82> received unknown vendor ID: 81:0f:a5:65:f8🆎14:36:91:05:d7:06:fb:d5:72:79
          Jul 24 11:19:03 charon 11[ENC] <82> received unknown vendor ID: 90:cb:80:91:3e:bb:69:6e:08:63:81:b5:ec:42:7b:1f
          Jul 24 11:19:03 charon 11[ENC] <82> received unknown vendor ID: 4a:13:1c:81:07:03:58:45:5c:57:28:f2:0e:95:45:2f
          Jul 24 11:19:03 charon 11[ENC] <82> received unknown vendor ID: af:ca:d7:13:68:a1:f1:c9:6b:86:96:fc:77:57:01:00
          Jul 24 11:19:03 charon 11[IKE] <82> 125.5.78.227 is initiating an IKE_SA
          Jul 24 11:19:03 charon 11[IKE] <82> IKE_SA (unnamed)[82] state change: CREATED => CONNECTING
          Jul 24 11:19:03 charon 11[CFG] <82> selecting proposal:
          Jul 24 11:19:03 charon 11[CFG] <82> proposal matches
          Jul 24 11:19:03 charon 11[CFG] <82> received proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
          Jul 24 11:19:03 charon 11[CFG] <82> configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
          Jul 24 11:19:03 charon 11[CFG] <82> selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
          Jul 24 11:19:03 charon 11[ENC] <82> generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
          Jul 24 11:19:03 charon 11[NET] <82> sending packet: from 125.5.78.228[500] to 125.5.78.227[500] (376 bytes)

          Jul 24 11:18:45 charon 15[CFG] <81> selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
          Jul 24 11:18:45 charon 15[ENC] <81> generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
          Jul 24 11:18:45 charon 15[NET] <81> sending packet: from 125.5.78.228[500] to 125.5.78.227[500] (376 bytes)
          Jul 24 11:18:50 charon 11[CFG] vici client 1116 connected
          Jul 24 11:18:50 charon 11[CFG] vici client 1116 registered for: list-sa
          Jul 24 11:18:50 charon 15[CFG] vici client 1116 requests: list-sas
          Jul 24 11:18:50 charon 07[CFG] vici client 1116 disconnected
          Jul 24 11:18:56 charon 08[CFG] vici client 1117 connected
          Jul 24 11:18:56 charon 10[CFG] vici client 1117 registered for: list-sa
          Jul 24 11:18:56 charon 10[CFG] vici client 1117 requests: list-sas
          Jul 24 11:18:56 charon 08[CFG] vici client 1117 disconnected

          1 Reply Last reply Reply Quote 0
          • G
            Gap
            last edited by

            I really dont get why im getting this.

            Jul 24 11:46:08 charon 05[CFG] <83> configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
            Jul 24 11:46:08 charon 05[CFG] <83> selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
            Jul 24 11:46:08 charon 05[ENC] <83> generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
            Jul 24 11:46:08 charon 05[NET] <83> sending packet: from 125.5.78.228[500] to 125.5.78.227[500] (376 bytes)

            1 Reply Last reply Reply Quote 0
            • kiokomanK
              kiokoman LAYER 8
              last edited by

              it is better if you post screenshot of what you have done, both device

              ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
              Please do not use chat/PM to ask for help
              we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
              Don't forget to Upvote with the 👍 button for any post you find to be helpful.

              1 Reply Last reply Reply Quote 0
              • G
                Gap
                last edited by

                This is my config on pfsense:
                phase 1:
                eea4f849-86ad-4f4d-bead-d10006d01620-image.png
                8c37ef6e-f0cb-420e-8f13-6432a4ceb350-image.png
                phase 2:
                8a542511-3491-4e80-8c00-33f84787dc7b-image.png
                1543b050-413a-4add-baaa-789e789b227e-image.png

                1 Reply Last reply Reply Quote 0
                • G
                  Gap
                  last edited by

                  And here's my config on my dlink router:
                  57f9703b-1c89-4713-b0fa-d5a90089ee63-image.png
                  dfeb7033-c769-4b93-b9dc-650a30a19d05-image.png
                  1d0544e5-abe8-4f12-b6bb-432d42839028-image.png
                  f20b6f6f-cf73-4dac-b499-6f28141741af-image.png
                  49b3fc1e-c1cf-4a36-8090-cbfeb370d461-image.png
                  c55cb428-f42a-4221-8846-3d8835a624ef-image.png

                  1 Reply Last reply Reply Quote 0
                  • G
                    Gap
                    last edited by

                    And when I'm initiating the VPN connection from dlink to pfsense this is what I get:
                    0baec00e-121c-448f-b68a-1f1678193df2-image.png

                    but when im initiating the vpn on pfsense to dlink this is what I only get:
                    f4cec567-a5c1-4a5b-994a-3f015987e26c-image.png

                    K 1 Reply Last reply Reply Quote 0
                    • K
                      Konstanti @Gap
                      last edited by Konstanti

                      @Gap
                      Hi,
                      try to do so

                      dea73eb6-c3fc-4733-bc15-72a5a70a1dc0-image.png

                      if it doesn't help , show the file
                      /var/etc/ipsec/ipsec.conf

                      G 1 Reply Last reply Reply Quote 0
                      • G
                        Gap @Konstanti
                        last edited by

                        @Konstanti hi thank you but still it didnt work wait ill try to get the file that you wanna see.

                        1 Reply Last reply Reply Quote 0
                        • kiokomanK
                          kiokoman LAYER 8
                          last edited by

                          i don't think you need to enable nat traversal on phase 1

                          ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                          Please do not use chat/PM to ask for help
                          we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                          Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                          G 1 Reply Last reply Reply Quote 0
                          • G
                            Gap @kiokoman
                            last edited by

                            @kiokoman hi yes i just left it on but i dont think thats the problem,, here's the file that you're asking I just improvised so forgive me haha.

                            b84f5eab-87df-4932-bcea-0af461491677-image.png
                            b8b4e8c6-2096-4c59-8abc-792a9f7be243-image.png

                            1 Reply Last reply Reply Quote 0
                            • kiokomanK
                              kiokoman LAYER 8
                              last edited by kiokoman

                              remote ip is 202.175.233.250
                              why do you have 125.5.78.227 on pfsense log?

                              ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                              Please do not use chat/PM to ask for help
                              we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                              Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                              G 1 Reply Last reply Reply Quote 0
                              • G
                                Gap @kiokoman
                                last edited by

                                @kiokoman sorry the first part was my first config and right now I changed it. to make it simple.

                                1 Reply Last reply Reply Quote 0
                                • kiokomanK
                                  kiokoman LAYER 8
                                  last edited by

                                  are port udp 500 and 4500 open on 125.5.78.227 ?
                                  228 is filtered but 227 result closed to me

                                  ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                                  Please do not use chat/PM to ask for help
                                  we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                                  Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                                  G 3 Replies Last reply Reply Quote 0
                                  • G
                                    Gap @kiokoman
                                    last edited by

                                    @kiokoman let me try hang on. I'm also confused about this dlink router.

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      Yeah from the first IPsec log it appears .227 is not receiving the traffic / allowing it in.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      G 1 Reply Last reply Reply Quote 0
                                      • G
                                        Gap @kiokoman
                                        last edited by

                                        @kiokoman Hi sir I think I just need to open port 500 because I dont do NAT traversal and this port 4500 is for NAT traversal right?

                                        1 Reply Last reply Reply Quote 0
                                        • G
                                          Gap @kiokoman
                                          last edited by

                                          @kiokoman right now I'm getting this logs from pfsense

                                          09[NET] <10> received packet: from 125.5.78.227[500] to 125.5.78.228[500] (508 bytes)

                                          Jul 29 10:08:23 charon 09[ENC] <10> parsed IKE_SA_INIT request 0 [ SA KE No V ]

                                          Jul 29 10:08:23 charon 09[CFG] <10> looking for an IKEv2 config for 125.5.78.228...125.5.78.227
                                          Jul 29 10:08:23 charon 09[CFG] <10> candidate: 125.5.78.228...125.5.78.227, prio 3100
                                          Jul 29 10:08:23 charon 09[CFG] <10> found matching ike config: 125.5.78.228...125.5.78.227 with prio 3100
                                          Jul 29 10:08:23 charon 09[ENC] <10> received unknown vendor ID: af:ca:d7:13:68:a1:f1:c9:6b:86:96:fc:77:57:01:00
                                          Jul 29 10:08:23 charon 09[IKE] <10> 125.5.78.227 is initiating an IKE_SA
                                          Jul 29 10:08:23 charon 09[IKE] <10> IKE_SA (unnamed)[10] state change: CREATED => CONNECTING
                                          Jul 29 10:08:23 charon 09[CFG] <10> selecting proposal:
                                          Jul 29 10:08:23 charon 09[CFG] <10> proposal matches
                                          Jul 29 10:08:23 charon 09[CFG] <10> received proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
                                          Jul 29 10:08:23 charon 09[CFG] <10> configured proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
                                          Jul 29 10:08:23 charon 09[CFG] <10> selected proposal: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
                                          Jul 29 10:08:23 charon 09[ENC] <10> generating IKE_SA_INIT response 0 [ SA KE No N(MULT_AUTH) ]
                                          Jul 29 10:08:23 charon 09[NET] <10> sending packet: from 125.5.78.228[500] to 125.5.78.227[500] (512 bytes)

                                          1 Reply Last reply Reply Quote 0
                                          • G
                                            Gap @Derelict
                                            last edited by

                                            @Derelict @kiokoman

                                            I'm having hard time opening the port 500 for this dsr- dlink 1000 router

                                            but I think this is how to open it.

                                            749b3d44-0094-4366-a163-f1d886e137e2-image.png

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.