IPsec stops forwarding traffic when Captive Portal is enabled

[renedk]

Hi,

We have a problem similar to the one in https://forum.netgate.com/topic/42230/captive-portal-break-ipsec-tunnels-solved?_=1602674436600

When captive portal is enabled, the IPsec stops working.
I've tried adding the remote subnets in "Allowed IP Adresses", but that didn't help.

Our setup is 2.4.4-RELEASE-p3 in HA setup.

Pointers to where I should start looking in the firewall rules is much appreciated.

Thanks,
René

[viktor_g]

see https://forum.netgate.com/topic/42230/captive-portal-break-ipsec-tunnels-solved/4?_=1602674436600:

I've specified the remote Nework 192.168.1.0/24 in the "Allowed IP Address" tab in the Captive Portal.

so, you need to put remote IPsec networks to "Allowed IP Address"

[renedk]

@viktor_g said in IPsec stops forwarding traffic when Captive Portal is enabled:

so, you need to put remote IPsec networks to "Allowed IP Address"

Thank you for taking the time to reply to my post.... but did you even read it before replying?

BR,
René

[viktor_g]

yeap, I need to be more careful)

Ok, some questions:

1. same issue without HA?
2. "Allowed IP Adresses" direction
3. list of Captive Portal interfaces

[renedk]

Took a long time before I got around to testing this again.

1. The issue is the same with or without HA.
2. They're allowed in both directions.
3. There is a lot of interfaces. But it's only enabled on "VLAN_154". Which as you can guess, is a VLAN interface.

BR,
René

[renedk]

Forgot to add som additional information.

The tunnels actually doesn't stop forwarding everything.
I can still ping through the tunnels, but all other traffic seems to be blocked.
HTTP, RDP, SNMP, to mention a few.

//René

[viktor_g]

@renedk
Please show your IPsec VPN configuration