Tunnel up, can ping FW, and can configure through https, but no traffic routed

[steqve]

Hello guys,

I've been using pfSense for some years now but only used PPTP as VPN. Now I'm trying to use pfSense and Shew VPN together.

I have searched the forum for a similar problem but havn't found one.

The problem is that no data is routed from the mobile client to internal IP:s. Well, this is a common problem here…

But I can ping the FW, i can browse to the FW and configure it. I can ping the client from the FW so the link is really up and running.

I have double and triple checked the settings in pfSense and Shrew and they are the same.

There is a "pass all" rule for IPsec just as for PPTP (which works).

What could be the reason for the traffic not beeing routed? It seems like the IPsec->LAN rule is not working, but I cannot see why.

IP-setup of client in Shrew: 172.16.111.22/16

When tunnel is up, the route in windows looks like this:

172.16.0.0      255.255.0.0    172.16.111.22  172.16.111.22      1
172.16.111.22  255.255.255.255        127.0.0.1      127.0.0.1      30
172.16.255.255  255.255.255.255    172.16.111.22  172.16.111.22      30

IPsec log:

Apr 8 12:49:20 racoon: [Unknown Gateway/Dynamic]: ERROR: such policy does not already exist: "172.16.0.0/16[0] 172.16.111.22/32[0] proto=any dir=out"
Apr 8 12:49:20 racoon: [Unknown Gateway/Dynamic]: ERROR: such policy does not already exist: "172.16.111.22/32[0] 172.16.0.0/16[0] proto=any dir=in"
Apr 8 12:49:20 racoon: [Unknown Gateway/Dynamic]: INFO: IPsec-SA established: ESP XX[0]->YY[0] spi=2760772392(0xa48e0b28)
Apr 8 12:49:20 racoon: [Unknown Gateway/Dynamic]: INFO: IPsec-SA established: ESP XX[0]->YY[0] spi=47611494(0x2d67e66)
Apr 8 12:49:20 racoon: [Unknown Gateway/Dynamic]: INFO: no policy found, try to generate the policy : 172.16.111.22/32[0] 172.16.0.0/16[0] proto=any dir=in
Apr 8 12:49:20 racoon: [Unknown Gateway/Dynamic]: INFO: respond new phase 2 negotiation: XX[0]<=>YY[0]
Apr 8 12:49:01 racoon: INFO: generated policy, deleting it.
Apr 8 12:49:01 racoon: [Unknown Gateway/Dynamic]: INFO: ISAKMP-SA established XX[500]-YY[4849] spi:2eddb914b17bf772:34953d56716b0602
Apr 8 12:49:01 racoon: INFO: received Vendor ID: DPD
Apr 8 12:49:01 racoon: INFO: received broken Microsoft ID: FRAGMENTATION
Apr 8 12:49:01 racoon: INFO: received Vendor ID: RFC 3947
Apr 8 12:49:01 racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-03
Apr 8 12:49:01 racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
Apr 8 12:49:01 racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-01
Apr 8 12:49:01 racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-00
Apr 8 12:49:01 racoon: INFO: begin Aggressive mode.
Apr 8 12:49:01 racoon: [Unknown Gateway/Dynamic]: INFO: respond new phase 1 negotiation

As I have heard, the two errors are not the issue. Correct?

And status:

Source  Destination  Protocol  SPI  Enc. alg.  Auth. alg. 
aa bb ESP a48e0b28 3des-cbc hmac-sha1
bb bb ESP 02d67e66 3des-cbc hmac-sha1

ip-rule for IPsec:

Proto  Source  Port  Destination  Port  Gateway  Schedule  Description

• • • • • • IPSEC passthruu

Ping FW: 172.16.0.1 works ok!
Ping 172.16.111.22 from FW works ok!
Ping any other IP from client = no response

Best regards,

Stefan Johansson

[steqve]

No ideas?

Should I have any other rule than the one for IPSec?

[jimp]

The subnets which you are using overlap. That may be part of the problem.

[steqve]

I have now changed the LAN network to 172.16.0.0/19 which has the subnet 255.255.224.0 and the mobile client is set to use IP 172.16.200.22 wchich means that the client is not within the /19 subnet. Still the same error.

[steqve]

changed mobile warrior to use 192.168 network and now it works fine.