Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense CE IPSec Possible Bug Accepting Any IPv4 Address

    Scheduled Pinned Locked Moved IPsec
    ipsecdynamic ip
    1 Posts 1 Posters 497 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • 0
      0x00FE 0
      last edited by

      Hello,

      I have three sites:

      Site A (Main office):
      Using pfSense appliance (22.01)
      Static IP

      Site B (Home):
      Using virtualized pfSense CE on Proxmox (2.6.0)
      Static IP

      Site C (Warehouse):
      Using old pfSense appliance/computer both using pfSense CE (2.6.0)
      Dynamic IP

      Site A and B are connected through IPSec, where Site B initiates the connection and Site A is (Responder Only).
      Site A and C are connected though IPSec , where Site C initiates the connection and Site A is (Responder Only).

      Site C tries to initiate a connection to Site B but is unable to finish phase 1.
      Site B has "Remote Gateway" set to "0.0.0.0" but will not accept any connections unless the IP of Site C is specified.
      Site A has no issue accepting connections from Site C with "Remote Gateway" set to "0.0.0.0", unlike Site B.

      After several days of troubleshooting, what works is:
      Manually set the "Remote Gateway" in Site B to the dynamic IP of Site C (Not practical)
      OR
      Use dynamic DNS and set the "Remote Gateway" in Site B to be the FQDN of of the dynamic DNS record of Site C.

      It seems that the option of accepting "0.0.0.0" for "Remote Gateway" in IPSec phase 1 in pfSense CE is not behaving similar to the appliance, but I can be wrong or missing something.

      I have deleted the tunnels and reconfigured them several times to ensure both sides have the same configurations, only the IP configuration makes it or breaks it.

      If anyone can replicate and confirm similar behavior, it could be submitted as a bug.

      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.