Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Setting up IPsec VPN pfsense to dsr dlink-1000 router

    Scheduled Pinned Locked Moved IPsec
    32 Posts 5 Posters 3.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      Gap
      last edited by

      Just adding this system logs on my pfsense please help. my problem still not fixed.

      Jul 24 11:19:00 charon 05[JOB] <80> deleting half open IKE_SA with 125.5.78.227 after timeout
      Jul 24 11:19:00 charon 05[IKE] <80> IKE_SA (unnamed)[80] state change: CONNECTING => DESTROYING
      Jul 24 11:19:02 charon 14[CFG] vici client 1118 connected
      Jul 24 11:19:02 charon 14[CFG] vici client 1118 registered for: list-sa
      Jul 24 11:19:02 charon 14[CFG] vici client 1118 requests: list-sas
      Jul 24 11:19:02 charon 05[CFG] vici client 1118 disconnected
      Jul 24 11:19:03 charon 11[NET] <82> received packet: from 125.5.78.227[500] to 125.5.78.228[500] (432 bytes)
      Jul 24 11:19:03 charon 11[ENC] <82> parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_D_IP) N(NATD_S_IP) V V V V ]
      Jul 24 11:19:03 charon 11[CFG] <82> looking for an IKEv2 config for 125.5.78.228...125.5.78.227
      Jul 24 11:19:03 charon 11[CFG] <82> candidate: %any...%any, prio 24
      Jul 24 11:19:03 charon 11[CFG] <82> candidate: 125.5.78.228...125.5.78.227, prio 3096
      Jul 24 11:19:03 charon 11[CFG] <82> found matching ike config: 125.5.78.228...125.5.78.227 with prio 3096
      Jul 24 11:19:03 charon 11[ENC] <82> received unknown vendor ID: 81:0f:a5:65:f8🆎14:36:91:05:d7:06:fb:d5:72:79
      Jul 24 11:19:03 charon 11[ENC] <82> received unknown vendor ID: 90:cb:80:91:3e:bb:69:6e:08:63:81:b5:ec:42:7b:1f
      Jul 24 11:19:03 charon 11[ENC] <82> received unknown vendor ID: 4a:13:1c:81:07:03:58:45:5c:57:28:f2:0e:95:45:2f
      Jul 24 11:19:03 charon 11[ENC] <82> received unknown vendor ID: af:ca:d7:13:68:a1:f1:c9:6b:86:96:fc:77:57:01:00
      Jul 24 11:19:03 charon 11[IKE] <82> 125.5.78.227 is initiating an IKE_SA
      Jul 24 11:19:03 charon 11[IKE] <82> IKE_SA (unnamed)[82] state change: CREATED => CONNECTING
      Jul 24 11:19:03 charon 11[CFG] <82> selecting proposal:
      Jul 24 11:19:03 charon 11[CFG] <82> proposal matches
      Jul 24 11:19:03 charon 11[CFG] <82> received proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
      Jul 24 11:19:03 charon 11[CFG] <82> configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
      Jul 24 11:19:03 charon 11[CFG] <82> selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
      Jul 24 11:19:03 charon 11[ENC] <82> generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
      Jul 24 11:19:03 charon 11[NET] <82> sending packet: from 125.5.78.228[500] to 125.5.78.227[500] (376 bytes)

      Jul 24 11:18:45 charon 15[CFG] <81> selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
      Jul 24 11:18:45 charon 15[ENC] <81> generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
      Jul 24 11:18:45 charon 15[NET] <81> sending packet: from 125.5.78.228[500] to 125.5.78.227[500] (376 bytes)
      Jul 24 11:18:50 charon 11[CFG] vici client 1116 connected
      Jul 24 11:18:50 charon 11[CFG] vici client 1116 registered for: list-sa
      Jul 24 11:18:50 charon 15[CFG] vici client 1116 requests: list-sas
      Jul 24 11:18:50 charon 07[CFG] vici client 1116 disconnected
      Jul 24 11:18:56 charon 08[CFG] vici client 1117 connected
      Jul 24 11:18:56 charon 10[CFG] vici client 1117 registered for: list-sa
      Jul 24 11:18:56 charon 10[CFG] vici client 1117 requests: list-sas
      Jul 24 11:18:56 charon 08[CFG] vici client 1117 disconnected

      1 Reply Last reply Reply Quote 0
      • G
        Gap
        last edited by

        I really dont get why im getting this.

        Jul 24 11:46:08 charon 05[CFG] <83> configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
        Jul 24 11:46:08 charon 05[CFG] <83> selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
        Jul 24 11:46:08 charon 05[ENC] <83> generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
        Jul 24 11:46:08 charon 05[NET] <83> sending packet: from 125.5.78.228[500] to 125.5.78.227[500] (376 bytes)

        1 Reply Last reply Reply Quote 0
        • kiokomanK
          kiokoman LAYER 8
          last edited by

          it is better if you post screenshot of what you have done, both device

          ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
          Please do not use chat/PM to ask for help
          we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
          Don't forget to Upvote with the 👍 button for any post you find to be helpful.

          1 Reply Last reply Reply Quote 0
          • G
            Gap
            last edited by

            This is my config on pfsense:
            phase 1:
            eea4f849-86ad-4f4d-bead-d10006d01620-image.png
            8c37ef6e-f0cb-420e-8f13-6432a4ceb350-image.png
            phase 2:
            8a542511-3491-4e80-8c00-33f84787dc7b-image.png
            1543b050-413a-4add-baaa-789e789b227e-image.png

            1 Reply Last reply Reply Quote 0
            • G
              Gap
              last edited by

              And here's my config on my dlink router:
              57f9703b-1c89-4713-b0fa-d5a90089ee63-image.png
              dfeb7033-c769-4b93-b9dc-650a30a19d05-image.png
              1d0544e5-abe8-4f12-b6bb-432d42839028-image.png
              f20b6f6f-cf73-4dac-b499-6f28141741af-image.png
              49b3fc1e-c1cf-4a36-8090-cbfeb370d461-image.png
              c55cb428-f42a-4221-8846-3d8835a624ef-image.png

              1 Reply Last reply Reply Quote 0
              • G
                Gap
                last edited by

                And when I'm initiating the VPN connection from dlink to pfsense this is what I get:
                0baec00e-121c-448f-b68a-1f1678193df2-image.png

                but when im initiating the vpn on pfsense to dlink this is what I only get:
                f4cec567-a5c1-4a5b-994a-3f015987e26c-image.png

                K 1 Reply Last reply Reply Quote 0
                • K
                  Konstanti @Gap
                  last edited by Konstanti

                  @Gap
                  Hi,
                  try to do so

                  dea73eb6-c3fc-4733-bc15-72a5a70a1dc0-image.png

                  if it doesn't help , show the file
                  /var/etc/ipsec/ipsec.conf

                  G 1 Reply Last reply Reply Quote 0
                  • G
                    Gap @Konstanti
                    last edited by

                    @Konstanti hi thank you but still it didnt work wait ill try to get the file that you wanna see.

                    1 Reply Last reply Reply Quote 0
                    • kiokomanK
                      kiokoman LAYER 8
                      last edited by

                      i don't think you need to enable nat traversal on phase 1

                      ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                      Please do not use chat/PM to ask for help
                      we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                      Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                      G 1 Reply Last reply Reply Quote 0
                      • G
                        Gap @kiokoman
                        last edited by

                        @kiokoman hi yes i just left it on but i dont think thats the problem,, here's the file that you're asking I just improvised so forgive me haha.

                        b84f5eab-87df-4932-bcea-0af461491677-image.png
                        b8b4e8c6-2096-4c59-8abc-792a9f7be243-image.png

                        1 Reply Last reply Reply Quote 0
                        • kiokomanK
                          kiokoman LAYER 8
                          last edited by kiokoman

                          remote ip is 202.175.233.250
                          why do you have 125.5.78.227 on pfsense log?

                          ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                          Please do not use chat/PM to ask for help
                          we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                          Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                          G 1 Reply Last reply Reply Quote 0
                          • G
                            Gap @kiokoman
                            last edited by

                            @kiokoman sorry the first part was my first config and right now I changed it. to make it simple.

                            1 Reply Last reply Reply Quote 0
                            • kiokomanK
                              kiokoman LAYER 8
                              last edited by

                              are port udp 500 and 4500 open on 125.5.78.227 ?
                              228 is filtered but 227 result closed to me

                              ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                              Please do not use chat/PM to ask for help
                              we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                              Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                              G 3 Replies Last reply Reply Quote 0
                              • G
                                Gap @kiokoman
                                last edited by

                                @kiokoman let me try hang on. I'm also confused about this dlink router.

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  Yeah from the first IPsec log it appears .227 is not receiving the traffic / allowing it in.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  G 1 Reply Last reply Reply Quote 0
                                  • G
                                    Gap @kiokoman
                                    last edited by

                                    @kiokoman Hi sir I think I just need to open port 500 because I dont do NAT traversal and this port 4500 is for NAT traversal right?

                                    1 Reply Last reply Reply Quote 0
                                    • G
                                      Gap @kiokoman
                                      last edited by

                                      @kiokoman right now I'm getting this logs from pfsense

                                      09[NET] <10> received packet: from 125.5.78.227[500] to 125.5.78.228[500] (508 bytes)

                                      Jul 29 10:08:23 charon 09[ENC] <10> parsed IKE_SA_INIT request 0 [ SA KE No V ]

                                      Jul 29 10:08:23 charon 09[CFG] <10> looking for an IKEv2 config for 125.5.78.228...125.5.78.227
                                      Jul 29 10:08:23 charon 09[CFG] <10> candidate: 125.5.78.228...125.5.78.227, prio 3100
                                      Jul 29 10:08:23 charon 09[CFG] <10> found matching ike config: 125.5.78.228...125.5.78.227 with prio 3100
                                      Jul 29 10:08:23 charon 09[ENC] <10> received unknown vendor ID: af:ca:d7:13:68:a1:f1:c9:6b:86:96:fc:77:57:01:00
                                      Jul 29 10:08:23 charon 09[IKE] <10> 125.5.78.227 is initiating an IKE_SA
                                      Jul 29 10:08:23 charon 09[IKE] <10> IKE_SA (unnamed)[10] state change: CREATED => CONNECTING
                                      Jul 29 10:08:23 charon 09[CFG] <10> selecting proposal:
                                      Jul 29 10:08:23 charon 09[CFG] <10> proposal matches
                                      Jul 29 10:08:23 charon 09[CFG] <10> received proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
                                      Jul 29 10:08:23 charon 09[CFG] <10> configured proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
                                      Jul 29 10:08:23 charon 09[CFG] <10> selected proposal: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
                                      Jul 29 10:08:23 charon 09[ENC] <10> generating IKE_SA_INIT response 0 [ SA KE No N(MULT_AUTH) ]
                                      Jul 29 10:08:23 charon 09[NET] <10> sending packet: from 125.5.78.228[500] to 125.5.78.227[500] (512 bytes)

                                      1 Reply Last reply Reply Quote 0
                                      • G
                                        Gap @Derelict
                                        last edited by

                                        @Derelict @kiokoman

                                        I'm having hard time opening the port 500 for this dsr- dlink 1000 router

                                        but I think this is how to open it.

                                        749b3d44-0094-4366-a163-f1d886e137e2-image.png

                                        1 Reply Last reply Reply Quote 0
                                        • kiokomanK
                                          kiokoman LAYER 8
                                          last edited by kiokoman

                                          no, you opened port from 1 to 500 for outgoing and from 1 to 4500 for incoming

                                          i don't known the dlink but you probably need 2 rules

                                          udp
                                          Outgoing
                                          start port 500
                                          to 500

                                          Incoming
                                          start port 500
                                          to 500

                                          another rules with

                                          udp
                                          outgoing
                                          start port 4500
                                          to 4500
                                          incoming
                                          start port 4500
                                          to 4500

                                          check if you have the latest firmware for the dlink

                                          ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                                          Please do not use chat/PM to ask for help
                                          we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                                          Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                                          G 2 Replies Last reply Reply Quote 0
                                          • G
                                            Gap @kiokoman
                                            last edited by

                                            @kiokoman I already done that but it didnt help that's why i go crazy wait hang on lemme change it. and for the firmware its already up to date sadly :(

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.