DHCP relay over IPSEC VPN?
Locutus last edited by
I'm a long-time user of pfSense (mostly on a virtual machine host), and have the following question:
I need to replace a hardware router (Netgear ProSafe) that's missing a feature required for its purpose: Sending DHCP relay packets through an IPSEC VPN tunnel while using VLANs.
The router is operating directly behind a DSL modem as primary router of two VLAN networks. One VLAN is a "classical on-site" network, router plays DHCP server, as Internet gateway for a number of PCs.
The router also establishes an IPSEC VPN to a remote site. A number of thin clients is connected to a second VLAN. That VLAN needs to operate in DHCP Relay mode. The DHCP server to forward requests to is reachable over the VPN (has a VPN IP).
The Netgear router does not support the latter: DHCP relay always gets forwarded through the public interface, and not through the VPN.
Can pfSense do better here? Does it forward DHCP relay packets through an IPSEC VPN tunnel if the relay target IP has an IP from the tunnel range?
No, it won't be able to properly relay DHCP across IPsec at this time.
The correct solution in either case is to configure DHCP relay on your switch instead. If it's a managed switch, it should support that either by the name DHCP Relay or perhaps "ip helper". If the switch performs the relay, the traffic can properly traverse the tunnel in either direction.
I'm currently use a pfsense to establish an IPSEC tunnel between A and B. The tunnel is established and all traffic from A go through this tunnel (the remote network B is declared as 0.0.0.0/0). My DHCP Server is at B site but when I try to use DHCP relay on the A site, the DHCP request isn't send inside the tunnel. How can I do that ?
Read my last reply just above yours.
So without another device it's impossible to do that ? Because before used pfSense I used a Cisco ASA and it worked fine.
Why the DHCP Discover isn't push inside the tunnel by pfSense ?
Because of the way the relay daemon works and how the packets are formed by the OS, it does not match the IPsec SA. It's probably trying to send it out a different interface.
You can try nudging it with a route but it's not likely to help for relay.
I tryed to add a fake route to the LAN interface as written here : https://doc.pfsense.org/index.php/Why_can%27t_I_query_SNMP,_use_syslog,_NTP,_or_other_services_initiated_by_the_firewall_itself_over_IPsec_VPN but it doesn't work…
That's about all you can do at the OS level to nudge it the right way. IPsec, as it is at the moment, just can't deal well with that kind of traffic at the OS level. OpenVPN should work better, or move the relay job to an external device.
Eventually when IPsec virtual tunnel interfaces come around that might help, but it's still possible that something in the relay daemon might hold it back.
I don't understand why some firewalls can do that and it's not possible on FreeBSD, it's the only thing which doesn't work, everything else works perfectly…
In this case I can't use OpenVPN.
Different operating systems, different IP stacks, different relay implementations, different IPsec implementations. You're comparing apples and oranges and wondering why the apple doesn't taste like an orange.
It doesn't work, so find an alternate solution (non-IPsec VPN, move the relay to a managed switch where it belongs, don't use relay, don't use pfSense for that specific VPN/relay, etc)