Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense 2.5.0 broke all IPSec VPNs

    Scheduled Pinned Locked Moved IPsec
    25 Posts 8 Posters 8.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      thiagocrepaldi @m0nji
      last edited by

      Maybe that helps, but my IPsec tunnel broke after upgrading to pfsense 2.5.0 because the "Peer identifier" was set to Any in both sides. By changing it to "IP address" 0.0.0.0, things got working again.

      My IPSec uses dynamic ip in both ends, so i cant use real IPs here

      ? 1 Reply Last reply Reply Quote 0
      • 612brokeaf6
        612brokeaf @m0nji
        last edited by

        @m0nji said in [pfSense 2.5.0 broke all IPSec VPNs]

        btw: is the "status --> ipsec" page for you all that slow? it takes around 10sec before it shows me the status.

        Yes, same here.

        1 Reply Last reply Reply Quote 1
        • ?
          A Former User @thiagocrepaldi
          last edited by

          @thiagocrepaldi I have it set to "IP Address". It's like that on all of my firewalls, so it's strange that out of 5 upgrades, 2 failed (1 done twice).

          1 Reply Last reply Reply Quote 0
          • C
            cliobrando
            last edited by cliobrando

            Same problem here, but cannot make it work, I have deleted all the config and created a single phase1 using the same configuration that worked in 2.4.5-p1:

            EDIT: Nevermind, erased everything, and started from zero fixed the problem.

            Thanks!

            1 Reply Last reply Reply Quote 2
            • jimpJ
              jimp Rebel Alliance Developer Netgate
              last edited by jimp

              Seems there are several issues here all getting confused.

              • Identifier issues with "Distinguished Name" (Which is a bug -- see https://redmine.pfsense.org/issues/11442 -- for a quick workaround, apply the patch there or just set your IDs to KeyID in the meantime)
              • Identifier issues from incorrect use of Key ID in the past (which fell back to automatic guessing at the type, so may not now match a remote not set specifically to Key ID) -- To fix this, set the right ID type and value on both sides to match
              • Configuration issues where the configuration is failing to load (with errors)
              • Tunnels loading but not connecting
              • Other things that haven't yet been identified

              Having one thread for all of this is a giant mess that's hard to follow. It's better for the moment if everyone makes their own thread here in the IPsec category and includes as much detail as possible.

              If someone else does have a thread for the exact same root issue then you can combine those threads, but this one is far too generic to be useful.

              For those of you who say re-creating the tunnel worked, be sure to grab the config.xml and compare before/after as well as /var/etc/ipsec/swanctl.conf -- something must be different if it suddenly started working, and if it's something done by the upgrade process then we can identify and fix it.

              For troubleshooting, first apply patches to fix known issues which have already been resolved:

              • ead6515637a34ce6e170e2d2b0802e4fa1e63a00 #11435
              • 57beb9ad8ca11703778fc483c7cba0f6770657ac #11435
              • 10eb04259fd139c62e08df8de877b71fdd0eedc8 #11442
              • ded7970ba57a99767e08243103e55d8a58edfc35 #11486
              • afffe759c4fd19fe6b8311196f4b6d5e288ea4fb #11487
              • 2fe5cc52bd881ed26723a81e0eed848fd505fba6 #11488

              After that, edit/save/apply an IPsec tunnel, then stop and start (not restart) the IPsec daemon, or reboot instead.

              If problems persist, do the following:

              • Edit/save a tunnel
              • Apply changes
              • Go to Status > Services and stop, then start the IPsec service (don't click restart)
              • Go to Status > IPsec on one end and attempt to initiate the tunnel if it doesn't come up automatically.

              If it works, great. If not:

              • Run swanctl --list-conns to see what the IPsec daemon loaded for the connections
              • Run swanctl --load-all --file /var/etc/ipsec/swanctl.conf --debug 1 and see if it reports any problems
              • Get the config from /var/etc/ipsec/swanctl.conf
              • Get the most recent logs from both sides

              With that in hand, check for an existing thread which matches the symptoms exactly. If one exists, post there. If there isn't one, create one.

              Locking this so it doesn't keep growing and making things more confusing.

              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

              Need help fast? Netgate Global Support!

              Do not Chat/PM for help!

              1 Reply Last reply Reply Quote 6
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.