Sending firewall-originated traffic via IPSEC VPN?
-
I'm using Let's Encrypt on my pfsense box for it's own hostname and a few things that are behind HAProxy on the same firewall.
The master DNS server I need to make updates to only has an internal IP and that IP is reached via an IPSEC VPN that connects to another location.
The IPSEC tunnel has been working fine for years and all the LAN traffic that needs to traverse it is fine. But when LE tries to run an nsupdate against this internal DNS server on the other end of the tunnel, it fails, as it seems firewall-originated traffic does not hit the VPN, but just goes out via the default route.
What's the best way to fix this? A route? NAT rule? Both? Neither?
-
If it's a policy based IPSec tunnel the only workaround I'm aware of is adding a static route via the LAN:
https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/access-firewall-over-ipsec.html#static-route-workaroundSteve
