IPSec Mobile client internet access

[albgen]

Hello,

i have setup a IKEv2 mobile ipsec for windows client and is working fine.
The problem is that once connected, windows does not have internet. Reaching the subnet LAN on pfSense is working.

Now i saw that in order to accomplish that needs to have a local network of 0.0.0.0/0 on P2.
The problem is that i cannot set this value because i get the error "Phase2 with this Local Network is already defined for mobile clients."

i really don't understand what is the issue.

thanks

[hzrnbgy]

Try just sending the pfsense subnet to the Windows client. So if the subnet behind pfsense if 192.168.XX.XX/24, use that instead of 0.0.0.0/0 in the Local Network Address section. This is what they call Split-tunneling. Giving mobile clients 0.0.0.0/0 means all their traffic is routed to the VPN which would cause the Internet on the client to go down if the firewall rule isnt applied properly in pfsense

[albgen]

@hzrnbgy Well, i tried your suggestions but did not work because is the same as setting on "Local Network" = "LAN subnet" instead of "Network" like shown on the screenshot.

[hzrnbgy]

Are you using Windows built-in IPSec VPN client? If so, you should not use Tunnel Mode IPSec since that is more suited for site-to-site VPN. Your use case if more of Transport Mode IPSec.

[albgen]

@hzrnbgy yes, i'm using the builtin Windows Client VPN. Still, even in trasport mode does not work. Cannot even reach the LAN network.

[albgen]

@albgen said in IPSec Mobile client internet access:

0.0.0.0/0 on P2.

on previous version of pfSense, entering this subnet was working.
Why did they changed by not allowing to eneter that subnet?

[hzrnbgy]

Do you mind posting your P1 and P2 configuration so we can try work out the settings? You can remove personal info such as IPs and passwords

[albgen]

Phase1



Phase2


Mobile Client section