• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

IPSec VTI - can ping from pfSense but not from LAN computer

Scheduled Pinned Locked Moved IPsec
ipsec
16 Posts 4 Posters 2.7k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • V
    viragomann @mclaborn
    last edited by Nov 24, 2022, 3:33 PM

    @mclaborn
    Maybe the destination device blocks access from outside of its own subnet.
    This is the default behavior of the most network activated computers.

    M 1 Reply Last reply Nov 26, 2022, 3:28 PM Reply Quote 0
    • M
      mclaborn @viragomann
      last edited by Nov 26, 2022, 3:28 PM

      @viragomann I think if that were the case I would not be able to ping from the pfSense.

      Mitch

      1 Reply Last reply Reply Quote 0
      • M
        mclaborn
        last edited by Nov 26, 2022, 4:00 PM

        I feel like this has something to do with routing. Packet capture shows pings trying to go out on the WAN interface rather than the VPN interface.

        Mitch

        G 2 Replies Last reply Nov 26, 2022, 4:38 PM Reply Quote 0
        • G
          gabacho4 Rebel Alliance @mclaborn
          last edited by gabacho4 Nov 26, 2022, 4:40 PM Nov 26, 2022, 4:38 PM

          @mclaborn Can you please specify what IP subnets are at each side of your connection? You say you have a static route for 10.91.0.0/16 but at which end? And does the other end have a static route set up for the opposite side? You've given scant details really.

          EDIT: please provide screenshots of your P1 and P2 for both sides of the ipsec connection. I will have to trust that you've created the appropriate interfaces on each side and added the necessary firewall rules. Also, I will assume that you've created policy based routing (PBR) rules that allow local LAN to use VTI interface for remote IPs access.

          1 Reply Last reply Reply Quote 0
          • G
            gabacho4 Rebel Alliance @mclaborn
            last edited by Nov 26, 2022, 4:44 PM

            @mclaborn I strongly believe you are missing PBR rule(s).

            M 1 Reply Last reply Nov 26, 2022, 8:19 PM Reply Quote 0
            • M
              mclaborn @gabacho4
              last edited by Nov 26, 2022, 8:19 PM

              @gabacho4 Missing PBR was the problem, thank you.

              Weird though - I modeled this new VPN after an existing one that is working correctly and the existing one does not have any PBR.

              Mitch

              G 1 Reply Last reply Nov 27, 2022, 4:10 AM Reply Quote 0
              • G
                gabacho4 Rebel Alliance @mclaborn
                last edited by Nov 27, 2022, 4:10 AM

                @mclaborn glad it’s working now. Don’t see how the other could possibly be working without PBR if it is a VTI IPSec setup. That’s the whole point of VTI. If it’s a traditional policy-based IPSec connection (tunnel mode for the P2) then yes, you don’t need the PBR because the policy creates those routes.

                M 1 Reply Last reply Nov 29, 2022, 4:57 PM Reply Quote 0
                • M
                  mclaborn @gabacho4
                  last edited by Nov 29, 2022, 4:57 PM

                  @gabacho4 I don't understand either. The one that is working without PBR does have static routes defined (on the local end).

                  Mitch

                  G R 2 Replies Last reply Nov 29, 2022, 4:59 PM Reply Quote 0
                  • G
                    gabacho4 Rebel Alliance @mclaborn
                    last edited by Nov 29, 2022, 4:59 PM

                    @mclaborn is the vti gateway set as the default for your network?

                    M 1 Reply Last reply Nov 29, 2022, 5:25 PM Reply Quote 0
                    • R
                      rcoleman-netgate Netgate @mclaborn
                      last edited by Nov 29, 2022, 5:08 PM

                      @mclaborn said in IPSec VTI - can ping from pfSense but not from LAN computer:

                      I don't understand either. The one that is working without PBR does have static routes defined (on the local end).

                      I had a ticket last night from someone that had a PBR and a VTI and he couldn't get anything going because the pings were hitting the PBR rule and pushing it out.

                      Our solution was to disable the PBR to verify, but then I suggested he set up a rule that takes all non-RFC1918 addresses and PBR that out his WAN2 instead. He'll likely go that route in the end but it was a definite learning experience for both of us.

                      Ryan
                      Repeat, after me: MESH IS THE DEVIL! MESH IS THE DEVIL!
                      Requesting firmware for your Netgate device? https://go.netgate.com
                      Switching: Mikrotik, Netgear, Extreme
                      Wireless: Aruba, Ubiquiti

                      M 1 Reply Last reply Nov 29, 2022, 5:32 PM Reply Quote 0
                      • M
                        mclaborn @gabacho4
                        last edited by Nov 29, 2022, 5:25 PM

                        @gabacho4 No

                        Mitch

                        1 Reply Last reply Reply Quote 0
                        • M
                          mclaborn @rcoleman-netgate
                          last edited by Nov 29, 2022, 5:32 PM

                          @rcoleman-netgate That's just as strange as mine. It feels like there is something flaky going on here with routing and VTI. I'm willing to dig into it more if you want to try to figure it out.

                          Mitch

                          R 1 Reply Last reply Nov 29, 2022, 5:42 PM Reply Quote 0
                          • R
                            rcoleman-netgate Netgate @mclaborn
                            last edited by Nov 29, 2022, 5:42 PM

                            @mclaborn Do packet captures... first on the interface it comes in on, then on the one it should go out on, then on the rest... that's how we confirmed it was a PBR that was passing his ICMP for the VTI destination out through WAN2.

                            Ryan
                            Repeat, after me: MESH IS THE DEVIL! MESH IS THE DEVIL!
                            Requesting firmware for your Netgate device? https://go.netgate.com
                            Switching: Mikrotik, Netgear, Extreme
                            Wireless: Aruba, Ubiquiti

                            M 1 Reply Last reply Nov 29, 2022, 5:45 PM Reply Quote 0
                            • M
                              mclaborn @rcoleman-netgate
                              last edited by Nov 29, 2022, 5:45 PM

                              @rcoleman-netgate I did that already as I was trying to figure it out. Doing a ping from a computer on the LAN to an address on the other side of the VPN, before adding PBR:

                              • packet capture on LAN shows ping outgoing but no reply
                              • packet capture on VTI does not show anything
                              • packet capture on WAN shows ping outgoing but no reply

                              Mitch

                              R 1 Reply Last reply Nov 29, 2022, 6:02 PM Reply Quote 0
                              • R
                                rcoleman-netgate Netgate @mclaborn
                                last edited by Nov 29, 2022, 6:02 PM

                                @mclaborn Ok from there Id check the Routes table, I'd check all your firewall rules, and I'd run a tracert to see if if it going somewhere funky.

                                Also check your Outbound NAT rules to see if there's a redirect there, too, or maybe you have a 1:1 that is translating the IP to something else.

                                Ryan
                                Repeat, after me: MESH IS THE DEVIL! MESH IS THE DEVIL!
                                Requesting firmware for your Netgate device? https://go.netgate.com
                                Switching: Mikrotik, Netgear, Extreme
                                Wireless: Aruba, Ubiquiti

                                1 Reply Last reply Reply Quote 0
                                16 out of 16
                                • First post
                                  16/16
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                  This community forum collects and processes your personal information.
                                  consent.not_received