Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSec - tunnel acces over tunnel

    Scheduled Pinned Locked Moved
    IPsec
    2
    10
    774
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      BerndRisch
      last edited by

      Hello everyone,

      i have a smart question and i hope its not to difficult to get an answer.

      I have 2 PFsense and a local fritzbox

      One with 10.0.0.0/22 and one with 10.0.4.0/22

      On my office, i have an IPSec tunnel from 192.168.2.0/24 to 10.0.0.0/22 - works fine.

      From 10.0.0.0/22 to 10.0.4.0/22 is an IPSec tunnel, works fine.
      Traffic from local network (10.0.0.0 to 10.0.4.0 and 10.0.4.0 to 10.0.0.0) works fine

      Now i want to access the ip adresses from 10.0.4.0 from the network 192.168.2.0 over 10.0.0.0/22

      So, how is this possible to setup?

      Thanks all for your help!

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @BerndRisch
        last edited by

        @berndrisch said in IPSec - tunnel acces over tunnel:

        I have 2 PFsense and a local fritzbox
        One with 10.0.0.0/22 and one with 10.0.4.0/22
        On my office, i have an IPSec tunnel from 192.168.2.0/24 to 10.0.0.0/22 - works fine.

        May I presume, the 10.0.0.0/22 and 10.0.4.0/22 are behind the two pfSense and 192.168.2.0/24 behind the Fritzbox?

        As far as I know, FB IPSec only supports a single phase 2?

        B 1 Reply Last reply Reply Quote 0
        • B
          BerndRisch @viragomann
          last edited by

          @viragomann Hey, right, so is it.

          But the traffic had to be routet from fritzbox to pfsense 10.0.4.0 over the 10.0.0.0.

          The network from fritzbox to 10.0.0.0 is a 10.0.0.0/8
          So, the Fritzbox knows where to send the traffic if the action is coming from a PC or anything else

          V 1 Reply Last reply Reply Quote 0
          • V
            viragomann @BerndRisch
            last edited by viragomann

            @berndrisch said in IPSec - tunnel acces over tunnel:

            The network from fritzbox to 10.0.0.0 is a 10.0.0.0/8

            So you have also on pfSense set the local network to 10.0.0.0/8 in p2, I guess?
            However, 10.0.0.0/21 would be even sufficient. You should occupy the whole 10.0.0.0/8.

            Then you also need to add an additional p2 to the connection between the both pfSense with 192.168.2.0/24 as local and 10.0.4.0/22 as remote on the box in 10.0.0.0/22. And on the other box the other way round.

            B 1 Reply Last reply Reply Quote 0
            • B
              BerndRisch @viragomann
              last edited by

              @viragomann So, thanks again

              thats on 10.0.0.0
              f88f442d-2f18-4e23-91e2-ec1975674366-image.png

              and this is on 10.0.4.0

              f69ab656-293b-459c-aa30-4d321a467a92-image.png

              is that right?

              V 1 Reply Last reply Reply Quote 0
              • V
                viragomann @BerndRisch
                last edited by

                @berndrisch
                Seems to me if all P2 are in a single P1, which cannot be the case.

                Apart from that, on 10.0.0.0 you have to correct the second tunnels remote network. .1 is not a network address.

                And on 10.0.4.0 the second tunnel is useless.

                B 2 Replies Last reply Reply Quote 0
                • B
                  BerndRisch @viragomann
                  last edited by

                  @viragomann thanks now it works fine.

                  Only one thing, the fritbox network is availabe from the 10.0.4.0 network.
                  So i have to block it with the firewall

                  1 Reply Last reply Reply Quote 0
                  • B
                    BerndRisch @viragomann
                    last edited by

                    @viragomann hey again, sorry!

                    We have now the Problem, that one "Customer" had the same ip range on his site as we on our own. (Screenshot)

                    6aa7aa14-5a95-4572-8091-6ea0ebfc3a91-image.png

                    When we start the IPSec tunnel from the Customer, we cannot connect anymore anything from the 10.0.8.0 netzwork (local network pfsense)

                    Any ideas?

                    V 1 Reply Last reply Reply Quote 0
                    • V
                      viragomann @BerndRisch
                      last edited by

                      @berndrisch said in IPSec - tunnel acces over tunnel:

                      We have now the Problem, that one "Customer" had the same ip range on his site as we on our own. (Screenshot)

                      I cannot see any overlapping remote networks in the screenshot.

                      When we start the IPSec tunnel from the Customer, we cannot connect anymore anything from the 10.0.8.0 netzwork (local network pfsense)

                      Also not clear, who 10.0.8.0 is involved here. That is neither part of your local networks as you stated above, nor one of the shown remote networks.

                      In general if there are any overlaps in IPSec involved networks you can nat one of them as a workaround.

                      B 1 Reply Last reply Reply Quote 0
                      • B
                        BerndRisch @viragomann
                        last edited by

                        @viragomann Hi

                        10.0.0.0 is connected over ipsec to 10.0.8.0

                        And our local destination 192.168.2.0 is connected over ip sec to 10.0.0.0

                        The location of the customer with 192.168.2.0 ist connected to 10.0.8.0

                        When the customer starts vpn, then wen cant connect from 192.168.2.0 over 10.0.0.0

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.