Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How-to on GRE over IPSEC?

    Scheduled Pinned Locked Moved IPsec
    2 Posts 2 Posters 1.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bobkoure
      last edited by

      I'm looking to add GRE tunnels over IPSEC for fail-over. I've been unable to find a how-to. Any pointers?

      This is for two IPSEC tunnels between 2 offices. pfSense 2.4.2 on Netgate hardware in both offices. Both offices have multiple ISPs, both have static IPs. I'm looking to use GRE and routing to enable fail-over of the IPSEC tunnels between the two offices - unless there's a better way?
      I had this working between a pair of snapgear boxes; required a bit of scripting to change routing when one route became unavailable.
      Thanks!

      1 Reply Last reply Reply Quote 0
      • G
        georgeman
        last edited by

        It can be done but with a couple of caveats, the main problem is that you have to pretty much turn off the firewall over the tunnels (!!!) due to #4479

        Also, strongSwan cannot currently establish 2 tunnels to the same destination IP from different interfaces (because the gateway selection is based on hidden static routes). To overcome this you can do the other way around, first GRE and then encrypt the tunnels (IPsec-over-GRE) or even set up another tunnel inside the other one.

        Finally, you can use OSPF to handle the failover but beware there is a long going unresolved issue with Quagga in which some routes are incorrectly marked as kernel routes and never cleared on restart, rendering the configuration useless. You may have better luck with frr.

        Two more points, remember to tweak MSS clamping appropriately to avoid performance issues, and also you can use GIF instead of GRE to save on some bytes.

        You can also achieve all the same thing with OpenVPN + OSPF by the way.

        If it ain't broke, you haven't tampered enough with it

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.