Why can't I query SNMP, use syslog, NTP

[alfredo]

Dear Forum,

We setup a successful tunnel between 2 pfsense boxes and their subnets.

We cannot ping to the subnet in the tunnel, and found this article:

http://doc.pfsense.org/index.php/Why_can%27t_I_query_SNMP,_use_syslog,_NTP,_or_other_services_initiated_by_the_firewall_itself_over_IPsec_VPN%3F

Our local subnet is 10.18.1.0/24 with pfsense at .1
Our remote subnet is 10.5.1.0/24 with pfsense at .1

Could not quite figure out the parameters to set from that article, but tried:

• added gateway in (System:Gateways): BackToLan - LAN - 10.18.1.1
• added route in (System:Static Routes): 10.5.1.0/24 - BackToLan - LAN

Now ping shows weird errors: e.g

gt3:~ dennis$ ping 10.5.1.201
PING 10.5.1.201 (10.5.1.201): 56 data bytes
36 bytes from fw-office.webappz.int (10.18.1.1): Redirect Host(New addr: 10.5.1.201)
Vr HL TOS  Len  ID Flg  off TTL Pro  cks      Src      Dst
4  5  00 0054 a2d8  0 0000  40  01 c029 10.18.1.200  10.5.1.201

Request timeout for icmp_seq 0
36 bytes from fw-office.webappz.int (10.18.1.1): Redirect Host(New addr: 10.5.1.201)
Vr HL TOS  Len  ID Flg  off TTL Pro  cks      Src      Dst
4  5  00 0054 abb5  0 0000  40  01 b74c 10.18.1.200  10.5.1.201

Please help. Thanks.

[cmb]

Your description of the route seems ok, but those redirects indicate it's not. You don't need a route at all for LAN to LAN traffic to function, only for traffic initiated by the firewall itself and only where you don't specify the source IP. Sounds like you have something else wrong there, maybe missing firewall rules on IPsec.

[alfredo]

Hi Cmb,

Thanks for you response. So we don't need to do this gateway+route trick for inter-tunnel pings?
The ping was from a local machine to a remote machine. Before the trick, it would give 100% packet loss only.
Like mentioned before, the other tunnel traffic had works fine, even before we put this silly trick in.

In Firewall: Rules: IPSec, we have
    TCP - 10.5.1.0/24 - * - * - * - * - none -  - Tunnel

Please help in getting ping, snmp, etc. working through the tunnel. Thanks.

[cmb]

First get rid of the static route as that isn't needed to ping and if it's wrong as it looks to be it may be breaking things.

Check if the traffic is getting blocked in the firewall logs, if it is, your IPsec rules aren't permitting the traffic.

[alfredo]

:)
Hi cmb,

Yes; that was the problem.

I got rid of the silly route and gateway, and changed the IPSec rule for protocol any (*) instead of just TCP, and that solved it. Maybe, pfsense could recommend 'any' as a default protocol for IPSec firewall rules.

Thanks so much.

Alfredo