Route from OpenVPN (ovpns2) to policy-based IPSec (enc0)
-
Hello folks,
just registered in the forum, since I have a problem, which I did not manage to solve yet, even after hours of googling.
First of all I will give some background about my setup:
- SiteA: Azure Cloud (Azure VPN Gateway) 172.16.0.0/16
- SiteB: Central VPN Aggregator with OPNSense (no dedicated VPN network, VPN router only)
- SiteC: Branch Office with pfSense Router 10.13.42.0/24
Here is how the sites are be connected)
SiteA (172.16.0.0/16) <--- IPSec ---> SiteB <--- OpenVPN ---> SiteC (10.13.42.0/24)
The networks 172.16.0.0/16 and 10.13.42.0/24 are not configured as LAN on SiteB but only in the IPSec and OpenVPN config accordingly.
My goal is that clients from 172.16.0.0/16 can reach clients in 10.13.42.0/24 and vica versa via the central VPN aggregator (SiteB)
The VPNs are established and working but unfortunately the traffic is not routed from the OpenVPN to the policy-based S2S IPSec. To debug the VPN setup (routing), I initiated a ping from a client in Site A (172.16.0.0/16). The ICMP packets are routed as expected at least on the way from SiteA to SiteB to SiteC but getting stuck at SiteB on the way back:
As said, I pinged a client [10.13.42.1 (pfSense Router)] at SiteC from a client in SiteA (172.16.2.4). The packet capture at SiteB looks as follows:
As you can see, the packet reaches SiteC, an according response is sent (echo reply) but then the reply gets stuck a SiteB, since it is not routed to the IPSec VPN to SiteA.
Firewalls for IPSec and OpenVPN are widely open (pass any), so that it is not a firewalling issue. Based on some google research, I added a 2nd phase2 between SiteA and SiteB, so that the internal OpenVPN transfer network (10.1.2.0/30) is known by the IPSec but this does not seem to do the trick. However, not make sense in my opinion anyway.
I am quite confident that the traffic gets stuck on the way back, since the packets (echo reply) is not routed from the OpenVPN to the policy-based site-to-site IPSec between Site B and Site A.
However, I have no idea how to solve that?
-
Hi folks,
to make it more comprehensible, I create a high-level network drawing representing this case.
Hope that someone can help?
-
@gnatbite
Obviously there is an issue between the Azure VPN and OPNSense. So I'm wondering, why you're requesting this here.Possibly there is something wrong with the routes on OPNSense.
-
I am posting this here, since I am hoping for someone who knows the solution to it.
However, I did some reasearch in the meantime and figured that I will need to change the IPSec from Tunnel-Mode to Route-Based (Virtual Tunnel Interfaces (VTI)). Will provide an update once I found a solution but this articel should do what I need:
https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/routed-vti.html
-
My solution is documented here.
https://forum.opnsense.org/index.php?topic=25957.msg125506#msg125506