Local traffic on a VLAN with a remote gateway
-
So I should submit a bug then, right? More of a new feature I guess.
We are able to do this with Cisco ASAs btw. It's not like I'm just making up networking concepts.
-
Not a bug.
When we get routed IPsec in 2.5-ish it might be possible.
Use an ASA then I guess. FreeBSD IPsec traffic selectors work how they work at this time.
-
@derelict not getting why this should be an issue.. There are direct routes in play for the local networks - why would it force it down the tunnel.. Should only go do the default route tunnel if there is no more direct route.
@fauxshow - why not just do with openvpn vs ipsec? Then you do a simple policy base routing.
-
Because the traffic selectors are hit before the routing table. They have no concept of states or anything like reply-to.
He has a selector source PROXY net dest any (0.0.0.0/0).
Reply traffic matches that so that's where it goes.
-
Ah.. Yeah that is a problem…
