<![CDATA[Block with no log rule on WAN breaks IPsec rekeying]]>

<![CDATA[Block with no log rule on WAN breaks IPsec rekeying]]>To stop the logs getting full of rubbish I added an explicit "block IPv4 any any" to the WAN interfaces on a pair of firewalls which are connected using an IPsec VPN.
This seemed to work fine until the phase 2s tried to rekey.
The rekeying failed and the whole VPN was ripped down and reestablished.

Is that expected?

Disabling the block rules made everything work properly again.

Should I have added rules of allow IKE and ESP before the block rule? Or should the automatically added ones been enough?

Where do the automatically generated IPsec rules end up in processing order?
Is there a way I can see this?

Is there a better way to stop the default block rules logging?

]]>https://forum.netgate.com/topic/199348/block-with-no-log-rule-on-wan-breaks-ipsec-rekeyingRSS for NodeTue, 13 Oct 2026 04:37:54 GMTTue, 18 Nov 2025 13:42:25 GMT60