No IKEv2 Phase 1 with IPv6 Client

[rsdu]

Hi folks,

We are currently migrating from OpenVPN to a new IKEv2 VPN on a pfSense 24.03 box. I followed the guide to set up the VPN and access using IPv4 is fine (Phase 1 ok, Phase 2 ok, all good, traces of successful connections in ipsec.log). However, when connecting through IPv6 there is no Phase 1 connectivity. I was able to verify that:

• There is IPv6 traffic arriving on UDP Port 500 on the WAN interface of the pfSense box (verified through package capture)
• There is a listener to UDP Port 500 for IPv4 and IPv6 on all interfaces.
• IPv4 and IPv6 are configured in Phase 1 settings (dual stack).
• Other IPv6 traffic (e.g. SSH) is fine.

Unfortunately, there are no traces at all visible in the ipsec.log. Thus, I'm a bit short of ideas on how to further troubleshoot. Any idea is highly appreciated :)

Many thanks and best regards
Marvin

PS: My trials are with the defaults Windows 11 VPN client.

[rsdu]

@rsdu Even though the documentation states that firewall rules are added automatically, firewall log shows that incoming traffic is blocked by the "default IPv6 incoming block" rule. I added UDP Port 500 and ESP to the ruleset and there we go ...