Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSec problem with one-way traffic flow

    Scheduled Pinned Locked Moved IPsec
    8 Posts 3 Posters 407 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      crosstheroad
      last edited by crosstheroad

      Hi everyone,

      I have set up a tunnel between two 2.7.2CE VM's:

      111528e1-5c6a-472d-9475-9a3e69c49be5-image.png

      On SiteA pfSense is the primary gateway.
      On SiteB pfSense is not the primary gateway.

      P1 and P2 comes up but I can only get traffic to flow from the 172.16.136.0/24 side to the 10.12.105.0/24 side.

      I can ping:
      172.16.136.20 to 10.12.105.10
      172.16.136.14 to 10.12.105.10
      10.12.105.10 to 172.16.136.20

      I cannot ping:
      10.12.105.10 to 172.16.136.1
      10.12.105.10 to 172.16.136.14

      My firewall rules right now are Allow Any on all interfaces.

      It seems like I am missing something really basic.,.
      Hopefully someone can point me in the right direction.

      Thanks!

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @crosstheroad
        last edited by

        @crosstheroad said in IPSec problem with one-way traffic flow:

        On SiteA pfSense is the primary gateway.
        On SiteB pfSense is not the primary gateway.

        P1 and P2 comes up but I can only get traffic to flow from the 172.16.136.0/24 side to the 10.12.105.0/24 side.

        So I assume, you have added static routes for site A subnet at B.
        How did you do this?

        C 1 Reply Last reply Reply Quote 0
        • C
          crosstheroad @viragomann
          last edited by crosstheroad

          @viragomann
          Thanks for the reply.
          I have not configured any static routes on the pfSense VM's.
          I figured since traffic flowed without static routes from B to A that the opposite would be true as well.

          On the 172.16.136.14 VM I have added a static route in the OS for traffic destined for 10.12.105.0/24 to route through 172.16.136.20 (instead of the default gateway 172.16.136.1)
          I have also added a static route on the 10.12.105.10 VM since it is connected to multiple networks, but can still only reach the site B pfSense LAN IP address and nothing else on that subnet.

          What routes should I configure in the pfSense machines?

          V 1 Reply Last reply Reply Quote 0
          • V
            viragomann @crosstheroad
            last edited by

            @crosstheroad said in IPSec problem with one-way traffic flow:

            On the 172.16.136.14 VM I have added a static route in the OS for traffic destined for 10.12.105.0/24 to route through 172.16.136.20 (instead of the default gateway 172.16.136.1)
            I have also added a static route on the 10.12.105.10 VM since it is connected to multiple networks, but can still only reach the site B pfSense LAN IP address and nothing else on that subnet.

            You should at least be able to reach 172.16.136.14, which has the static route set.
            If the machine doesn't respond though, it probably blocks access from outside of its local subnet by its own firewall.

            C 1 Reply Last reply Reply Quote 0
            • C
              crosstheroad @viragomann
              last edited by crosstheroad

              @viragomann
              I double checked the static route configuration on the 172.16.136.14 VM and traffic between the two VM's now work!
              Thanks for guiding me in the right direction.

              Ideally I would like for the static route magic to happen in the VMware edge gateway, so that individual configuration of VM's is not needed.
              I added this in the Edge gateway configuration:
              1a52bca8-b37f-462d-95b1-cccfd7b6baa8-image.png
              The blurred Interface is the 172.16.136.1 interface of the edge gateway.

              9afd384a-7743-474a-a381-d6b07a3b88ee-image.png

              Using another Windows VM, 172.16.136.107, without a static route configured, I cannot reach anything on the 10.12.105.0/24 network.

              Fully aware that I am now asking questions about a completely different product than pfSense, but I am hoping that I have just misunderstood something about static routes in general.

              V tinfoilmattT 2 Replies Last reply Reply Quote 0
              • V
                viragomann @crosstheroad
                last edited by

                @crosstheroad
                Sadly it's not as simple. Your setup will lead into asymmetric routing.

                Additionally to the static route you need to source-nat the traffic destined to the remote site to the interface IP on the edge gateway.
                Maybe you can do this on the NAT tab.

                Another, even better solution would be to move the pfSense into a separate virtual network. Then the LAN devices just send packets destined to A to the router, which forwards it to pfSense due to the static route. Traffic from A to B would arrive at pfSense and are forwarded to the router, because it's the upstream gateway, and there the packets are routed to the LAN devices.

                1 Reply Last reply Reply Quote 0
                • tinfoilmattT
                  tinfoilmatt @crosstheroad
                  last edited by

                  @crosstheroad Static route on 172.16.136.1 is good. I would remove the static route on 172.16.136.14 so you can troubleshoot/get this working properly.

                  I think you're going to have an asymmetric routing issue with having everything from Site B 'flow' through 172.16.136.1, since traffic returning from Site A will hit 172.16.136.20 and then be routed directly to whatever host on the 172.16.136.0/24 subnet directly without first passing back through 172.16.136.1.

                  Both these articles may be useful:

                  Advanced IPsec Settings
                  NAT with IPsec Phase 2 Networks

                  You should also be more specific when reporting what addresses/protocols/services you're testing connectivity with because @viragomann is right—your VM host OSes are likely to software-firewall block any incoming connections from any subnet they're not directly attached to.

                  1 Reply Last reply Reply Quote 0
                  • C
                    crosstheroad
                    last edited by

                    @viragomann @tinfoilmatt
                    Based on your feedback I read up on asymmetric routing and ended up skipping pfSense for this setup altogether 🙄
                    I always try to standardize on products but here it just lead to a level of network knowledge I do not fully understand.

                    I configured a basic IKEv1 tunnel in the edge gateway, added necessary firewall rules and everything worked as intended.
                    A sidenote is that IKEv2 did not work well in VMware NSX-V with the P2's being disconnected after 3600 seconds and not being able to reconnect without tearing down the P1 manually as well.

                    ef365c84-1553-4c71-8c60-fbb1827af9a7-image.png

                    Thanks everyone for your input!

                    1 Reply Last reply Reply Quote 0
                    • First post
                      Last post
                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.