Pass traffic from OpenVPN client to IPSec site-to-site TUnnel
-
Hello,
We use tunnelblick on a MAC to terminate a client OpenVPN VPN session to our headend pfsense. We are then creating an IPSec site-to-site tunnel to each of our downstream Palo Alto branch offices. How do I get traffic to pass from the OpenVPN client, to go down the IPSec tunnel? I've made rules in the IPSec interface to allow traffic sourcing from our OpenVPN VPN subnet to any on any port, but I cannot ping. If I do a packet capture on the pfsense for the OpenVPN interface I see the ping requests, but if I do a packet capture on the IPSec interface I do not see it there. -
@travis-fleming
You have to add a phase 2 in IPSec to connect the OpenVPN tunnel network with the remote network.
Remember to add the tunnel also on the remote site. -
@viragomann So you are saying add an additional phase 2 in my IPSec tunnel to connect the OpenVPN network?
-
Yes, exactly. The phase 2 policy has to match the traffic and here that would be from the OpenVPN tunnel subnet to the remote site subnet. The current P2 doesn't cover that so you need to add one that does, at both ends. Or expand the existing P2 subnet to include it. That may not be possible with your numbering scheme.
Steve
-
@stephenw10 This worked thanks guys!
