Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pfsense Site-to-Site IPSec IKEv2 Routing

    Scheduled Pinned Locked Moved IPsec
    6 Posts 2 Posters 883 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • I
      IonutZ
      last edited by

      Hey there,

      I'm looking for advice on how to route traffic between 2 non-PfSense routers over a PfSense-to-PfSense site-to-site IPSec IKEv2 connection.

      I've achieved a site-to-site connection successfully and I have all LAN clients from both sites talking to each other.

      Site A looks like this: Internet -> WAN -> LAN 10.0.0.0/24 -> Windows Server router at 10.0.0.2 using RRAS / NAT to a switch serving 24.0.1.0/24 (where all my Site A clients are connected)

      Site B looks like this: Internet -> WAN -> LAN 10.0.1.0/24 -> Windows Server router at 10.0.1.2 using RRAS / NAT to a switch serving 24.0.2.0/24 (where all my Site B clients are connected)

      Right now I have full duplex connectivity between 10.0.0.0/24 and 10.0.1.0/24 and therefore 24.0.1.0/24 can access everything in 10.0.1.0/24 and 24.0.2.0/24 can access everything in 10.0.0.0/24. However, I cannot figure out how to get 24.0.1.0/24 to talk to 24.0.2.0/24.

      Any help would be greatly appreciated.

      Thank you very much

      EDIT: I'm assuming NAT and some routes need to be applied in some way but I don't know how :<

      1 Reply Last reply Reply Quote 0
      • G
        georgeman
        last edited by

        Are you using 24.0.x.0/24 as the local internal networks for your hosts? Fix that first, it's a mistake that will bring you tons of headaches later on…

        With that said, if I understood correctly you just need to add IPsec Phase2 settings between 24.0.1.0/24 and 24.0.2.0/24 on both ends of the tunnel. That's it. You cannot really route in the traditional way with IPsec tunnels.

        If it ain't broke, you haven't tampered enough with it

        1 Reply Last reply Reply Quote 0
        • I
          IonutZ
          last edited by

          Hey! Thanks for the reply. I have a couple of diagrams that I have created that might clarify. What you said basically covers it. However, I'm afraid that may not be sufficient since the LAN clients on 10.x.x.x cannot access 24.x.x.x in either sites. I can ping from 24.x.x.x to 10.x.x.x on each site, however the reverse doesn't work because because the 24.x.x.x subnet is NAT-ed by the RRAS server as seen in the diagram. (Red means no connectivity)

          And yes, I will fix the 24.x.x.x subnets to a private IP range!

          ![Internal Diagram - Page 1 (1).png](/public/imported_attachments/1/Internal Diagram - Page 1 (1).png)
          ![Internal Diagram - Page 1 (1).png_thumb](/public/imported_attachments/1/Internal Diagram - Page 1 (1).png_thumb)

          1 Reply Last reply Reply Quote 0
          • G
            georgeman
            last edited by

            Ok, forget what I said earlier, in this case it wouldn't work. In fact I don't think it would ever work as long as those Windows Servers are still NAT'ing traffic. This is the main problem with NAT in general, you lose end to end connectivity. I can't think of a way to make it work because the 24.x.x.x networks are completely invisible and not routeable past each NAT'ing server.

            I'm afraid you will have to redesign that a little bit in order to get rid of unnecessary address translations.
            Can't you hook up both your 24.x.x.x and 10.x.x.x networks directly to the pfSense? Why does the 24.x.x.x network have to go through the other network first? If both reach pfsense directly, it will work pretty much straight away.

            BTW, great diagram!

            If it ain't broke, you haven't tampered enough with it

            1 Reply Last reply Reply Quote 0
            • I
              IonutZ
              last edited by

              I was starting to think this was the case because I can't find anyone that will give me a straight solution lol… so a static route won't work if that's the case?

              I really wanted to leverage RRAS for routing because most of my clients rely on Windows ADs that live in both sites. I've tried creating routes and stuff but I figured my lack of success was due to my lack of networking knowledge and lack of implementation experience with routing... :(

              1 Reply Last reply Reply Quote 0
              • I
                IonutZ
                last edited by

                Solved by removing the RRAS in between so now DHCP and NAT live on the PfSense firewalls. Thanks for the suggestion! Also no more 24.xxx subnets for private IPs!

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.