Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSec with VTI not routing LAN traffic between 2 sites

    Scheduled Pinned Locked Moved IPsec
    13 Posts 3 Posters 2.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      BeDazzler
      last edited by

      Thanks for the reply.

      So I've done that too.

      I have now configured site A with 10.10.161.1 and site B with 10.10.161.2 using /30.

      The session between site A and site B is established and from the diagnostics menu I can ping from side to side fine, however I cannot route any traffic from site A to site B. Both site A and site B show each other's remote gateways as online.

      As an example, on site A I've configured a static route for 8.8.8.0/24 to use the IPSEC VTI path 10.10.161.2, however no traffic routes if I ping 8.8.8.8 from a Windows machine connected to pfSense at site A.

      When I remove the static route, it returns to working fine.

      If I set the default gateway on site A to be the remote gateway on site B, that does not work either.

      Is there somewhere else I need to configure pfSense to allow the static route to pass traffic from site A to site B ?

      Many thanks

      BeDazzler.

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        You need a route for the reply traffic on the other side too.

        https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/routed-vti.html

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • B
          BeDazzler
          last edited by

          I have static routes on site A and site B.

          I want to route all site A traffic out of site B.

          I have configured a static route on site A for 0.0.0.0/24 to traverse 10.10.161.2 (Site B).

          pfSense still routes that traffic out the local WAN interface on site A.

          a tcpdump of ipsec1000 on site A pfSense shows there is no traffic going from pfSense on site A to site B, except for ICMP request and replies between 10.10.161.1 and 10.10.161.2.

          I see this in the IPSec logs:
          querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
          querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found

          It's not making sense to me.

          1 Reply Last reply Reply Quote 0
          • B
            BeDazzler
            last edited by

            OK I figured it out.

            In the firewall rules for LAN I needed to allow traffic to and from IPSECVTI at both site A and site B.

            I can now ping and route traffic from site A to site B and it works.

            Thanks.

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              You are going to need to outline everything you have done precisely. All routes, all firewall rules, any policy routing in place on the inside interfaces.

              I see this in the IPSec logs:
              querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 in failed, not found
              querying policy 0.0.0.0/0|/0 === 0.0.0.0/0|/0 out failed, not found

              Totally normal for logging on a VTI tunnel.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • B
                BeDazzler
                last edited by

                Well, it was working so I rebooted the pfSense appliances and now it's not.

                I've been able to get things working multiple times, but then after rebooting it stops working.

                If I try to set the default gateway on site A to local and then reset it to IPSecVTI it starts working again - regardless of what static routes I have in place.

                Site A:
                IPSec VPN configured with IKEV2/AES256 connects up to site B fine.
                P2 configured with local subnet 10.10.161.1/30, ESP, 256.
                Session establishes, from diagnostics menu site A can ping site B.
                No hosts on the LAN interface for site A can ping 10.10.161.2 at site B (this was previously working).

                Site B:
                IPSec VPN configured with IKEV2/AES256 connects up to site A fine.
                P2 configured with local subnet 10.10.161.2/30, ESP, 256.
                Session establishes, from diagnostics menu site B can ping site A.
                No hosts on the LAN interface for site B can ping 10.10.161.1 at site B (this was previously working).

                Firewall Rules - LAN on Site A:
                IPv4 LAN net to ANY (allow)
                IPv4 IPSECVTI net to ANY (allow)
                IPv4 ANY to IPSECVTI (allow)
                IPv4 ANY to ANY (allow)

                Firewall Rules - IPSec on Site A:
                IPv4 ANY to ANY (allow)

                Firewall Rules - LAN on Site B:
                IPv4 LAN net to ANY (allow)
                IPv4 IPSECVTI net to ANY (allow)
                IPv4 ANY to IPSECVTI (allow)
                IPv4 ANY to ANY (allow)

                Firewall Rules - IPSec on Site B:
                IPv4 ANY to ANY (allow)

                The pfSense appliance at site A has a local IP 172.25.9.252.
                I have a Windows PC connected to the LAN interface at 172.25.9.99.
                The Windows PC can ping 10.10.161.1 (site A VTI).

                The pfSense appliance at site B has a local IP 10.10.75.1.
                I have a Windows PC connected to the LAN interface at 10.10.75.52.
                The Windows PC cannot ping 10.10.161.2 (site B VTI) no matter what rules I put in place.

                It just doesn't work.

                1 Reply Last reply Reply Quote 0
                • B
                  BeDazzler
                  last edited by

                  Don't worry about this now, after 2 days trying to get this working I have dumped pfSense and moved onto something that works.

                  DerelictD 1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate @BeDazzler
                    last edited by

                    @BeDazzler It works fine. You misconfigured it. When I asked you to show everything you have done, you didn't show creating any static routes across the VTI for the LAN subnets.

                    https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/routed-vti.html#static-routes

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • B
                      BeDazzler
                      last edited by

                      I created static routes.

                      It might work for someone else, however if I can't get it to work reliably there's no way I can support it, so it's dead and in the bin.

                      I ended up configuring a CentOS machine with Open VPN client and routing between 2 NICs.

                      Works. Simple and easy for anyone to maintain.

                      Took 14 hours less to setup.

                      1 Reply Last reply Reply Quote 0
                      • jimpJ
                        jimp Rebel Alliance Developer Netgate
                        last edited by

                        If you are going to try routing Internet traffic like 8.8.8.8 across then you also need hybrid or manual outbound NAT rules to NAT traffic from a source of the subnet(s) across the VTI.

                        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                        Need help fast? Netgate Global Support!

                        Do not Chat/PM for help!

                        1 Reply Last reply Reply Quote 0
                        • B
                          BeDazzler
                          last edited by

                          Yep, tried that too.

                          To solve the problem, I just removed pfSense from site A and replaced it with a CentOS VM running OpenVPN client.

                          From there I have a VLAN on our Cisco LAN SW which has a DHCP scope to configure the LAN default gateway via OpenVPN.

                          Works perfectly.

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.