Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    IKEv2 routing

    Routing and Multi WAN
    2
    2
    798
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      ebg1223 last edited by

      Hi-

      I have setup a pfsense server running on google cloud compute for use in a small business for VPN access. We have everyone setup under IKEv2 on iOS devices, and have successfully setup extremely stable connections(MOBIKE!!!!). This was done following the guide: https://doc.pfsense.org/index.php/IKEv2_with_EAP-MSCHAPv2 with some minor tweaks. We have additional servers setup under google cloud that run internal applications, and given our mobile workforce possibly using public wifi or unsecure connections, need to route all traffic via VPN.

      Now the problem… Our staff experiences a significant amount of down-time in the field, and have previously used netflix/hulu at their discretion. With the new netflix vpn block, they are blocking outgoing requests coming from google cloud ip addresses, and when all traffic is routed over ike vpn, netflix/hulu is effectively blocked. Is it possible to not route netflix/hulu traffic over ikev2? If this is not possible, we also have a home office with a sonicwall firewall. Could we establish an additional ikev2 tunnel from pfsense to sonicwall, and route netflix/hulu traffic through the sonicwall, therefore giving it the ip of the home office? Any other solutions or recommendations?

      Thank you!

      1 Reply Last reply Reply Quote 0
      • jimp
        jimp Rebel Alliance Developer Netgate last edited by

        That is entirely up to the client side in these cases. If you can configure the client to only send traffic for your far-side VPN subnets across, then it should be closer to what you want. But with IKEv2 in this sort of setup the client makes all those decisions.

        If you only have your server network(s) in the P2 list and have checked "Provide a list of networks…" on the mobile clients tab, clients might respect that and stop sending all traffic over IKEv2, but support varies by client.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • First post
          Last post