IPsec tunnel up, but no route added?

Bozan

Hi,

I have established an IPsec tunnel to a Cisco PIX successfull.


INFO: IPsec-SA established: ESP Y.Y.Y.Y[0]->X.X.X.X[0] spi=2713566(0x2967de)
INFO: IPsec-SA established: ESP X.X.X.X[0]->Y.Y.Y.Y[0] spi=1804963616(0x6b958f20)

Tunnel config: 192.168.15.0/24(LAN_NET) <- X.X.X.X <=> Y.Y.Y.Y -> 10.11.12.13/32

The tunnels is pointing to a specific host address, not a network 10.11.12.13/32. Why I don't see any routing entry to the host after establishing the tunnel and why does pfSense route the traffic through the default gateway? How I can add a route to access the single host? Do I have to add a NAT rule?

With ifconfig -an I can't see any ipsec interfaces. Which makes it difficult to add a static route.

Thanks for help,

Bozan

jimp

IPsec does not use routes. The traffic is grabbed in the kernel.

As for testing, you should be testing from a client PC behind pfsense, not from the firewall itself, unless you have taken some steps first, as detailed here:

http://doc.pfsense.org/index.php/Why_can%27t_I_query_SNMP,_use_syslog,_NTP,_or_other_services_initiated_by_the_firewall_itself_over_IPsec_VPN%3F

Bozan

Jimp,

Thanks for the good hint. I have talked to the Admin of the other end of the tunnel and he told me I have to NAT my source IP to addr X.X.X.X. Is it also possible to set a external IP instead of the LAN IP in the static routes panel?

Thanks,

Bozan

jimp

Unfortunately you cannot NAT an address for IPsec in pfSense. It's a limitation of the underlying software. It's been talked about before, and a bounty was even put up at one time, but no solution has been completed.

As for static routes, you can set routes to external addresses on WAN, but they must be in the same subnet as WAN. You can't set a route to an arbitrary IP, it has to be a directly connected path.