Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    HTTPS over VPN

    IPsec
    3
    6
    4198
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      Seaniboy last edited by

      Hi

      I have recently setup and pfsense firewall and all is going well except for one thing, i have a IPSec site to site VPN setup to a Cisco ASA and most of that works great other than when trying to access HTTPS sites it will just sit there then timeout?? All other protocols / ports seem to be fine.

      I can access HTTPS coming from the ASA side fine and one thing i notice when trying to access HTTPS from the pfsense site i get alot of ICMP requests on the outside interface of the ASA but these just get denied as per the policy.

      Anyone have any idea what may cause this?

      1 Reply Last reply Reply Quote 0
      • jimp
        jimp Rebel Alliance Developer Netgate last edited by

        Any kind of web proxy involved? Tried doing a packet capture on the IPsec interface (enc0) on pfSense from the console?

        Can you telnet to port 443 on an https server on the other end of the VPN and actually get a connection?

        If it just times out, then the most likely causes are:

        • Network policies on the other end are blocking the traffic
        • Somehow that specific traffic is not going over the tunnel

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • S
          Seaniboy last edited by

          Hi

          Yes this is the odd think i can telnet to it no problem even when i do there though a browser i get a certificate warning but when i click continue it just sits there and eventually times out.

          This happen to anything running HTTPS??

          1 Reply Last reply Reply Quote 0
          • S
            Seaniboy last edited by

            Here is a capture -

            17:07:50.589265 IP 192.168.0.42.56481 > 192.168.168.11.https: Flags ~~, seq 1935385710, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
            17:07:50.633828 IP 192.168.168.11.https > 192.168.0.42.56481: Flags [S.], seq 3796794724, ack 1935385711, win 5840, options [mss 1380,nop,nop,sackOK,nop,wscale 4], length 0
            17:07:50.633960 IP 192.168.0.42.56481 > 192.168.168.11.https: Flags [.], ack 1, win 16560, length 0
            17:07:50.634341 IP 192.168.0.42.56481 > 192.168.168.11.https: Flags [P.], ack 1, win 16560, length 104
            17:07:50.677833 IP 192.168.168.11.https > 192.168.0.42.56481: Flags [.], ack 105, win 365, length 0
            17:07:50.684452 IP 192.168.168.11.https > 192.168.0.42.56481: Flags [P.], ack 105, win 365, length 746
            17:07:50.684491 IP 192.168.168.11.https > 192.168.0.42.56481: Flags [.], ack 105, win 365, length 0
            17:07:50.686274 IP 192.168.0.42.56481 > 192.168.168.11.https: Flags [F.], seq 105, ack 747, win 16373, length 0
            17:07:50.687405 IP 192.168.0.42.56482 > 192.168.168.11.https: Flags ~~, seq 847394701, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
            17:07:50.733924 IP 192.168.168.11.https > 192.168.0.42.56481: Flags [F.], seq 747, ack 106, win 365, length 0
            17:07:50.734295 IP 192.168.0.42.56481 > 192.168.168.11.https: Flags [.], ack 748, win 16373, length 0
            17:07:50.752696 IP 192.168.168.11.https > 192.168.0.42.56482: Flags [S.], seq 4144920032, ack 847394702, win 5840, options [mss 1380,nop,nop,sackOK,nop,wscale 4], length 0
            17:07:50.752880 IP 192.168.0.42.56482 > 192.168.168.11.https: Flags [.], ack 1, win 16560, length 0
            17:07:50.753372 IP 192.168.0.42.56482 > 192.168.168.11.https: Flags [P.], ack 1, win 16560, length 104
            17:07:50.806086 IP 192.168.168.11.https > 192.168.0.42.56482: Flags [.], ack 105, win 365, length 0
            17:07:50.822726 IP 192.168.168.11.https > 192.168.0.42.56482: Flags [P.], ack 105, win 365, length 746
            17:07:50.823694 IP 192.168.0.42.56482 > 192.168.168.11.https: Flags [P.], ack 747, win 16373, length 205
            17:07:50.898619 IP 192.168.168.11.https > 192.168.0.42.56482: Flags [P.], ack 310, win 432, length 59
            17:07:50.908629 IP 192.168.0.42.56482 > 192.168.168.11.https: Flags [F.], seq 310, ack 806, win 16358, length 0
            17:07:50.909168 IP 192.168.0.42.56483 > 192.168.168.11.https: Flags ~~, seq 2027597812, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
            17:07:50.954397 IP 192.168.168.11.https > 192.168.0.42.56483: Flags [S.], seq 1164984320, ack 2027597813, win 5840, options [mss 1380,nop,nop,sackOK,nop,wscale 4], length 0
            17:07:50.954574 IP 192.168.0.42.56483 > 192.168.168.11.https: Flags [.], ack 1, win 16560, length 0
            17:07:50.954995 IP 192.168.0.42.56483 > 192.168.168.11.https: Flags [P.], ack 1, win 16560, length 104
            17:07:50.958442 IP 192.168.168.11.https > 192.168.0.42.56482: Flags [F.], seq 806, ack 311, win 432, length 0
            17:07:50.959049 IP 192.168.0.42.56482 > 192.168.168.11.https: Flags [.], ack 807, win 16358, length 0
            17:07:50.999845 IP 192.168.168.11.https > 192.168.0.42.56483: Flags [.], ack 105, win 365, length 0
            17:07:51.005214 IP 192.168.168.11.https > 192.168.0.42.56483: Flags [P.], ack 105, win 365, length 746
            17:07:51.006204 IP 192.168.0.42.56483 > 192.168.168.11.https: Flags [P.], ack 747, win 16373, length 205
            17:07:51.067828 IP 192.168.168.11.https > 192.168.0.42.56483: Flags [P.], ack 310, win 432, length 59
            17:07:51.073971 IP 192.168.0.42.56483 > 192.168.168.11.https: Flags [F.], seq 310, ack 806, win 16358, length 0
            17:07:51.116774 IP 192.168.168.11.https > 192.168.0.42.56483: Flags [F.], seq 806, ack 311, win 432, length 0
            17:07:51.117822 IP 192.168.0.42.56483 > 192.168.168.11.https: Flags [.], ack 807, win 16358, length 0

            Any one have any ideas?~~~~~~

            1 Reply Last reply Reply Quote 0
            • ?
              Guest last edited by

              I had this issue, ended up being with the actual certificate. I used firefox, HTTPS worked fine. IE8 wouldn't allow me to download/install the certificate, while firefox right away allowed me to add it.

              after adding the certificate, my pages no longer partially loaded / went slow.

              1 Reply Last reply Reply Quote 0
              • S
                Seaniboy last edited by

                Seems i can access some HTTPS site but very very slow, the main thing i am trying to access is a Vsphere cluster but as the VPN is so slow just times out.

                I have tried alot to try and get this working but in the end have just put the VPN on a £20 router for the minute back to the ASA and it now works fine!?

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post