Floating-state rule for IPsec VTI is generated for the wrong interface when reqid ≠ ikeid, causing TCP stalls after ~64 KiB

ChristopheNet

Subject: Floating-state rule for IPsec VTI is generated for the wrong interface when reqid ≠ ikeid, causing TCP stalls after ~64 KiB

Version: 2.8.1-RELEASE (the same call is present on GitHub master as of 2026-02-18).

Setup: two pfSense VMs joined by a route-based IPsec (VTI) tunnel. On site A the VTI phase 1 has ikeid 2 but its phase 2 has reqid 6 (reqids 1–5 belong to another tunnel's phase 2 entries), so the interface is ipsec6. On site B ikeid = reqid = 2 (ipsec2).

Symptom: TCP connections initiated from site A across the tunnel stall after ~64 KiB (retransmissions never acknowledged). Connections initiated from site B work. ICMP of any size works, and PMTUD is fine (VTI MTU 1400).

Cause: in /etc/inc/filter.inc (~line 4546), ipsec_get_ifname($phase1_config, $phase1_config['ikeid']) passes the ikeid as the reqid argument. The interface is named ipsec<reqid>, so the "IPsec VTI floating states" rule is generated for ipsec2 (nonexistent on site A) instead of ipsec6. Outbound packets on ipsec6 then match the default "let out anything IPv4 from firewall host itself" rule, which creates an interface-bound state on ipsec6. Replies arrive via enc0 and never update it. The state stays SYN_SENT:CLOSED, and pf drops data outside the initial window (state-mismatch counter grows).

Evidence: pfctl -ss -vv shows two states for one connection (one ipsec6 state stuck in SYN_SENT:CLOSED with 0 reply packets, one floating ESTABLISHED). Captures show packets entering the LAN and never leaving the VTI. A floating pass-out rule with a floating state policy on the affected traffic fixes it (50 MB in 0.8 s).

Expected: the floating-states rule should use the actual interface name, ipsec<reqid> of the VTI phase 2.

Related: #15430 and #15431 (interface-bound state policy and VTI). This may duplicate or extend them.

marcosm

https://redmine.pfsense.org/issues/17151

ChristopheNet

@marcosm Thank you for your action and feedback.