Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Layer 2 Tunnel over Layer 3 (IPSec/GRE/GIF)

    Scheduled Pinned Locked Moved General pfSense Questions
    31 Posts 5 Posters 6.7k Views 4 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S Offline
      stephenw10 Netgate Administrator
      last edited by

      Circling back I think the answer here is that if you have to use that Cisco router at site B you will need to just route the traffic and have different subnets at each end.

      If you can replace it with pfSense there are more options but we would still recommend routing it with different subnets at each end.

      Steve

      1 Reply Last reply Reply Quote 0
      • P Offline
        prx
        last edited by

        Hi,

        at site B I have to use Cisco router, and following you advice, we will try to configure a tunnel GRE or IPSec.
        I'll keep you posted

        Thank you very much to all

        bingo600B 1 Reply Last reply Reply Quote 0
        • bingo600B Offline
          bingo600 @prx
          last edited by

          @prx

          Remember gre alone is unencrypted , it's just tunneling

          If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

          pfSense+ 23.05.1 (ZFS)

          QOTOM-Q355G4 Quad Lan.
          CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
          LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

          1 Reply Last reply Reply Quote 0
          • P Offline
            prx
            last edited by

            Hi,

            I am doing some tests using 2 pfsense (remeber that in production on site B I must use a Cisco Router). I created 2 GRE Tunnels and I can ping GRE Interfaces (from pfsense at site A to pfsense at site B and viceversa).
            The GRE interfaces are /30 subnets:
            GRE Tunnel 1 (for vlan 10)

            • 192.168.33.1/30 (Site A)
            • 192.168.34.2/30 (Site B)

            GRE Tunnel 2 (for vlan 30)

            • 192.168.34.1/30 (Site A)
            • 192.168.34.2/30 (Site B)

            Now the question is: how can I "bind" GRE Tunnel 1 (Site B) to vlan 10 and GRE Tunnel 2 (Site B) to Vlan 30? I ask it because all the traffic on vlan 10 at Site B must be forward at vlan 10 at site A (DHCP and all kind of traffic), and the same thing for vlan 30.
            Another question: At Site A, in addition to the GRE interfaces, do I need to create any particular interfaces?

            Thank you

            1 Reply Last reply Reply Quote 0
            • P Offline
              prx
              last edited by prx

              Ok,

              in my tests now I have the following interfaces (in addition to the GRE):
              Site A:

              • Test 1 (Vlan 10): 192.168.55.1/24
              • Test 2 (Vlan 30): 192.168.56.1/24

              Site B:

              • Test 1 (Vlan 10): 192.168.45.1/24
              • Test 2 (Vlan 30): 192.168.46.1/24

              Now the goal is to forward all the traffic of clients in Vlan A at Site B to the interface Test 1 (Vlan 10) at Site A, and, if it is possible, the clients at site B should receive their ip via a dhcp server enabled on the pfsense at site A.
              The same thing for vlan 30...
              Then for internet navigation of the clients at Site B is it enough to nat the subnets? Do I have to configure static routes?

              Thank you

              1 Reply Last reply Reply Quote 0
              • P Offline
                prx
                last edited by

                Ok,

                I went ahead with my tests and now i can surf the internet via the GRE Tunnel from the clients on vlan 10 at Site B. The only thing left to do is the implementation of the DHCP Server on PfSense at Site A, so the clients at Site B receive the right IPs:

                • Vlan 10: 192.168.45.0/24
                • Vlan 30: 192.168.46.0/24

                How can I achieve this goal?

                JKnottJ 1 Reply Last reply Reply Quote 0
                • JKnottJ Offline
                  JKnott @prx
                  last edited by JKnott

                  @prx

                  Are you sure you want to send company traffic over an unencrypted link?

                  PfSense running on Qotom mini PC
                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                  UniFi AC-Lite access point

                  I haven't lost my mind. It's around here...somewhere...

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S Offline
                    stephenw10 Netgate Administrator
                    last edited by

                    Mmm, I always assume GRE over IPSec but....

                    You will need to setup a dhcp relay at site B pointing to a dhcp server at site A. However that probably can't be pfSense since there is no way to add a dhcp server for a subnet it does not have an interface in.

                    Steve

                    P 1 Reply Last reply Reply Quote 0
                    • P Offline
                      prx @stephenw10
                      last edited by

                      @stephenw10

                      at this time I am doing only some tests. So, if I understood well, I can't use PfSense as DHCP Server at Site A...and if I will use IPSec VTI instead of GRE Tunnel?

                      Thank you

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S Offline
                        stephenw10 Netgate Administrator
                        last edited by

                        It wouldn't make any difference in terms of the dhcp server.

                        I would use routed IPSec there if the other router supports it if only because there are issues with GRE/IPSec in pfSense which it's better to avoid. And you definitely want to use encryption.

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.