Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Cannot get mobile IPSEC client to route over IPSec site-to-site tunnel

    Scheduled Pinned Locked Moved IPsec
    11 Posts 3 Posters 1.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jedblack
      last edited by

      I've searched but cannot find the fix. I have a simple setup if two sites running pfsense(latest ver)

      site#1
      wan : x.x.x.x
      lan : 192.168.2.0/24 (router is .1)
      ipsec mobile 192.168.10.0/24

      site#2
      wan : x.x.x.x
      lan : 192.168.3.0/24 (router is .1)
      ipsec mobile 192.168.11.0/24

      Yes, I've created the P2's on each side and flipped the local/remote network cidrs.

      I've opened up the WAN, LAN, and IPSEC interfaces with an ANY/ANY firewall rule.

      I can even see the inbound/outbound SPD's listed under the IPSEC status.

      But, no matter what i've tweaked I just can't get my ipsec mobile client(macos) sitting on 192.168.10.10 to ping 192.168.3.1

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        @jedblack said in Cannot get mobile IPSEC client to route over IPSec site-to-site tunnel:

        I’ve opened up the WAN, LAN, and IPSEC interfaces with an ANY/ANY firewall rule.

        Please immediately delete that pass any any rule on WAN. That has NOTHING to do with what is passed over an IPsec tunnel. Technical term for that rule is: "bad"

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • J
          jedblack
          last edited by

          Yep, I should have mentioned that was deleted before I made this post. I just did it as a hail mary test since I can't see any issues.

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Each side definitely needs phase 2 entries which include the other side's mobile tunnel network.

            Each side needs rules on the IPsec tab passing traffic FROM the other side's mobile tunnel network.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • M
              myms
              last edited by

              Hey @Derelict – thanks for your help in this thread. Actually running into the identical issue here, but don't quite understand what the solution is here.

              I've got a similar setup:

              IPSec Mobile: 10.1.0.0/24
              LAN1: 10.1.1.0/24

              ...and multiple site-to-site VPNs configured from the pfSense to other appliances/AWS (which live at 10.2.1.0/24, 10.3.1.0/24, etc.)

              For the life of me, can't get any IPSec Mobile clients to access any networks outside of LAN1 on the pfSense appliance itself. I also see the correct in/out SPDs for 10.1.0.0/24 <--> 0.0.0.0/24, and there are no firewall rules to my knowledge that could be intercepting this traffic.

              Would appreciate any help!

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by Derelict

                @yuddu2md said in Cannot get mobile IPSEC client to route over IPSec site-to-site tunnel:

                I also see the correct in/out SPDs for 10.1.0.0/24 <--> 0.0.0.0/24

                0.0.0.0/24? or 0.0.0.0/0?

                You might want to start nother thread with details about your specific issues.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • M
                  myms
                  last edited by

                  Err, sorry. It is indeed 0.0.0.0/0. Screenshots attached as well if they're helpful.

                  2_1532224658428_Screen Shot 2018-07-21 at 6.56.49 PM.png 1_1532224658427_Screen Shot 2018-07-21 at 6.56.30 PM.png 0_1532224658427_Screen Shot 2018-07-21 at 6.56.16 PM.png

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by Derelict

                    None of those traffic selectors will forward traffic between, for instance, 10.9.1.0/24 and the mobile clients at 10.1.0.0/24. They need to be told to send traffic destined for 10.1.0.0/24 to this firewall over the tunnel. The local subnet 10.1.1.0/24 does not need such a tunnel.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • M
                      myms
                      last edited by

                      @Derelict Thank you and understood, but how do you achieve that with the IPSec Mobile Client setup? Doesn't seem to be an option to specify other subnets to clients / create tunnels across other subnets.

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        It is not a problem with the mobile IPsec, but with the other tunnels. They need a "Phase 2" that matches the traffic.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • M
                          myms
                          last edited by

                          Bingo! That did the trick. Thank you :)

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.