Default static NAT for port 500 causes issues with iOS 16 and IPSec

artooro · Sep 28, 2022, 1:54 PM

By default pfSense has a static NAT port rule in Outbound NAT for port 500.

Starting with iOS 16 I've noticed issues where phones are having trouble making IKEv2 VPN connections from behind pfSense.
When one device makes a UDP 500 connection to initiate the IPSec connection, the state does not appear to get dropped and no other devices are able to connect. Previously the port 500 state was quickly recycled allowing devices to connect in fairly quick succession.

What I've done to workaround this is switch Outbound NAT to Hybrid mode, and create a rule for port 500 that does not have Static Port enabled.
After creating this rule to effectively disable the automatic built-in rule, the issues are resolved and all phones have no problem connecting to the VPN.

This may be a bug in iOS 16, but maybe it's time to add an option to System / Advanced / Firewall & NAT to disable the creation of "Auto created rule for ISAKMP"