Direct traffic in IPSECVPN Site to Site "Phase 2 Tunnels"?
-
QUESTION: How to you maneuver the direction of traffic inside the IPSEC VPN Phase 2 tunnels?
DETAILS:
I have an IPSEC Site to Site VPN connecting 2 offices, Austin and Houston. Inside the VPN are 2 x phase 2 tunnels that have "ANY" and "ANY" in the firewall rules. Basically these are wide open for multi-directional traffic using "any" protocol on "any" port. I use to use Watchguard firewalls and when setting up the vpns, you were able to tell the phase 2 tunnels which direction traffic was authorized to flow using symbols like those below. Can some please help me?
–---------> Out
---------< None
<----------- In
<----------> In and OutNEEDS:
I need both subnets (AUSTIN MGMT and AUSTIN STAFF) in Austin to be able to access 1 subnet (HOUSTON STAFF) in Houston & 1 subnet (HOUSTON STAFF) in Houston to be able to access 1 subnet (AUSTIN STAFF)in Austin.
AUSTIN MGT HOUSTON STAFF
(192.168.113.0/24 -------------> 10.77.30.0/24)AUSTIN STAFF HOUSTON STAFF
(192.168.115.0/24 <------------> 10.77.30.0/24)Thank you.
-
Look at the firewall rules on the IPsec tab. Those will pass traffic INTO that node over IPsec. Think of it like connections coming into WAN.
You can pass or block whatever traffic you desire there.
-
I only have 1 rule on both routers in my IPSEC firewall rules that says "Any" source to "Any" destination. Do I need to create 2 rules, 1 for each "Phase 2" tunnel?
Before
IPSEC-Both Routers Austin & Houston
Rule #1 PASS - Source (Network) 192.168.113.0/24 - Protocol "ANY" Destination (Network) 10.77.30.0/24 - Protocol "ANY"
–------------------------------
After
IPSEC - AUSTIN Router
Rule #1 PASS - Source (Network) 192.168.113.0/24 - Destination (Network) 10.77.30.0/24 - Protocol "ANY"
Rule #2 PASS - Source (Network) 192.168.115.0/24 - Destination (Network) 10.77.30.0/24 - Protocol "ANY"IPSEC -HOUSTON -Router
Rule #1 PASS - Source (Network) 10.77.30.0/24 - Destination (Network) 192.168.115.0/24 - Protocol "ANY"
Rule #2 BLOCK - Source (Network) 10.77.30.0/24 - Destination (Network) 192.168.113.0/24 - Protocol "ANY"Like this?
-
You need to create rules to pass, block, or reject any traffic you want to pass, block, or reject. Just like any other rules.
It looks like you have it backward. The rules govern traffic coming into the firewall they are on. Just like any other pfSense rules.
The rules on the Houston IPsec tab govern traffic coming into Houston from Austin. Austin is the source and Houston is the dest.
The rules on the Austin IPsec tab govern traffic coming into Austin from Houston. Houston is the source and Austin is the dest.And by traffic I mean connections. You have stateful behavior there like everywhere else.
-
That worked!!! Thank you very much.
