<![CDATA[Hypothetical routing question]]>A service provider asked me for help to connect their networks with a customers PFsense. Apparently they have several networks that needs to be reachable on customer side in order for a service to work. We have an IPSec tunnel up and running as per illustration, but they would like to make routable the other two networks as well.

Spontaneously I answered that the only way to do this is probably to connect one IPSec with each subnet, but he insisted they solved this with static routes in the past. So I thought I'd ask just to see if anyone has any other ideas.

alt text

]]>https://forum.netgate.com/topic/151584/hypothetical-routing-questionRSS for NodeTue, 13 Oct 2026 12:37:34 GMTMon, 23 Mar 2020 15:12:08 GMT60<![CDATA[Reply to Hypothetical routing question on Wed, 25 Mar 2020 14:07:00 GMT]]>@Derelict Thanks bud, we just tested what you said and it worked beautifully. The process was a bit tricky to understand because they used Unifi on the opposite side but after letting go of preconceptions and just tried everything just popped into place.

]]>https://forum.netgate.com/post/899138https://forum.netgate.com/post/899138Wed, 25 Mar 2020 14:07:00 GMT<![CDATA[Reply to Hypothetical routing question on Mon, 23 Mar 2020 20:50:41 GMT]]>pfSense can do IPsec in two different ways, policy-based and route-based (VTI)

To accomplish that scenario using policy-based you would make these IPsec networks (phase 2 tunnels) on both sides:

Site A

Local Network: 172.16.186.64/26 Remote Network: 10.5.0.0/24
Local Network: 172.16.203.128/28 Remote Network: 10.5.0.0/24
Local Network: 172.16.212.0/26 Remote Network: 10.5.0.0/24

Site B

Local Network: 10.5.0.0/24 Remote Network: 172.16.186.64/26
Local Network: 10.5.0.0/24 Remote Network: 172.16.203.128/28
Local Network: 10.5.0.0/24 Remote Network: 172.16.212.0/26

If you are already using an ESP phase 2 tunnel for the existing network, the most straightforward path would be to just add two more "Phase 2" tunnels to each side.

Using a VTI tunnel would establish a /30 point-to-point over which you can route any networks you like to the other side using static routes or routing protocols.

It doesn't look like the book has caught up yet (VTI is a newish feature) but this exists:

https://www.youtube.com/watch?v=AKMZ9rNQx7Y

]]>https://forum.netgate.com/post/898789https://forum.netgate.com/post/898789Mon, 23 Mar 2020 20:50:41 GMT