Setting up IPsec VPN pfsense to dsr dlink-1000 router

kiokoman

it is better if you post screenshot of what you have done, both device

Gap

This is my config on pfsense:
phase 1:

phase 2:

Gap

And here's my config on my dlink router:

Gap

And when I'm initiating the VPN connection from dlink to pfsense this is what I get:

but when im initiating the vpn on pfsense to dlink this is what I only get:

Konstanti

@Gap
Hi,
try to do so

if it doesn't help , show the file
/var/etc/ipsec/ipsec.conf

Gap

@Konstanti hi thank you but still it didnt work wait ill try to get the file that you wanna see.

kiokoman

i don't think you need to enable nat traversal on phase 1

Gap

@kiokoman hi yes i just left it on but i dont think thats the problem,, here's the file that you're asking I just improvised so forgive me haha.

kiokoman

remote ip is 202.175.233.250
why do you have 125.5.78.227 on pfsense log?

Gap

@kiokoman sorry the first part was my first config and right now I changed it. to make it simple.

kiokoman

are port udp 500 and 4500 open on 125.5.78.227 ?
228 is filtered but 227 result closed to me

Gap

@kiokoman let me try hang on. I'm also confused about this dlink router.

Derelict

Yeah from the first IPsec log it appears .227 is not receiving the traffic / allowing it in.

Gap

@kiokoman Hi sir I think I just need to open port 500 because I dont do NAT traversal and this port 4500 is for NAT traversal right?

Gap

@kiokoman right now I'm getting this logs from pfsense

09[NET] <10> received packet: from 125.5.78.227[500] to 125.5.78.228[500] (508 bytes)

Jul 29 10:08:23 charon 09[ENC] <10> parsed IKE_SA_INIT request 0 [ SA KE No V ]

Jul 29 10:08:23 charon 09[CFG] <10> looking for an IKEv2 config for 125.5.78.228...125.5.78.227
Jul 29 10:08:23 charon 09[CFG] <10> candidate: 125.5.78.228...125.5.78.227, prio 3100
Jul 29 10:08:23 charon 09[CFG] <10> found matching ike config: 125.5.78.228...125.5.78.227 with prio 3100
Jul 29 10:08:23 charon 09[ENC] <10> received unknown vendor ID: af:ca:d7:13:68:a1:f1:c9:6b:86:96:fc:77:57:01:00
Jul 29 10:08:23 charon 09[IKE] <10> 125.5.78.227 is initiating an IKE_SA
Jul 29 10:08:23 charon 09[IKE] <10> IKE_SA (unnamed)[10] state change: CREATED => CONNECTING
Jul 29 10:08:23 charon 09[CFG] <10> selecting proposal:
Jul 29 10:08:23 charon 09[CFG] <10> proposal matches
Jul 29 10:08:23 charon 09[CFG] <10> received proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
Jul 29 10:08:23 charon 09[CFG] <10> configured proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
Jul 29 10:08:23 charon 09[CFG] <10> selected proposal: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
Jul 29 10:08:23 charon 09[ENC] <10> generating IKE_SA_INIT response 0 [ SA KE No N(MULT_AUTH) ]
Jul 29 10:08:23 charon 09[NET] <10> sending packet: from 125.5.78.228[500] to 125.5.78.227[500] (512 bytes)

Gap

@Derelict @kiokoman

I'm having hard time opening the port 500 for this dsr- dlink 1000 router

but I think this is how to open it.

kiokoman

no, you opened port from 1 to 500 for outgoing and from 1 to 4500 for incoming

i don't known the dlink but you probably need 2 rules

udp
Outgoing
start port 500
to 500

Incoming
start port 500
to 500

another rules with

udp
outgoing
start port 4500
to 4500
incoming
start port 4500
to 4500

check if you have the latest firmware for the dlink

Gap

@kiokoman I already done that but it didnt help that's why i go crazy wait hang on lemme change it. and for the firmware its already up to date sadly :(

kiokoman

2.13 ?
https://tsd.dlink.com.tw/downloads2008.asp

Gap

@kiokoman

nope.