Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Multiple subnets

    Scheduled Pinned Locked Moved IPsec
    4 Posts 3 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • U
      Umberto
      last edited by

      Hello
      I have a question, I don't know if it's allready been asked, but I couldn't find it

      I have 2 pfsense's running both 2.0.1-RELEASE version, who are connected to each other with a couple of IPSec tunnels the pfsense in the main building does have 14 nics all with their own subnet.
      The other pfsense has 6 NICS all also with own NICS.
      The tunnels are working, but only for the network (subnet) where it's bound to, but I want to reach the other subnets aswell..

      Here a small drawing:

      –-------      IPSEC        --------
      |  PF 1  |  --------------- | PF 2 |
      ---------                        --------
        |  |                                |  |
      192.168.40.0/24              192.168.41.0/24
            |                                  |
            |                                  |
          192.168.70.0/24              192.168.71.0/24

      There are 4 ipsec tunnels, 2 from PF1 -> PF2 and 2 from PF2 -> PF1
      PF1->PF2 Local:192.168.40.0/24 remote:192.168.41.0/24
      PF1->PF2 Local:192.168.70.0/24 remote:192.168.71.0/24
      PF2->PF1 Local:192.168.41.0/24 remote:192.168.40.0/24
      PF2->PF1 Local:192.168.71.0/24 remote:192.168.70.0/24

      When I'm on the 192.168.40.0/24 network I can reach the 192.168.41.0/24 but I can't reach the 192.168.71.0/24

      On both firewalls all traffic is allowed (for testing) and I have played with outbound NAT but only thing I could get working is ping pf2 it's own ip (192.168.71.254)

      On pf 1.x I would have made static routes, but in 2.0 you can only make a route to a gw, and you can't make a gateway wich is outside a subnet...

      How can this be configured?
      Thanks in advance

      1 Reply Last reply Reply Quote 0
      • C
        chris23
        last edited by

        ahhhhgg! I've read about something like this somewhere and can't remember the answer, so someone may put me right in a minute.

        But first thought I had, did you try a second phase 2 across the phase 1 ipsec tunnel for the other networks?

        If I find the proper page or info I'll post it.  Check the wiki and do some searches…

        My weather station: http://rollestonpark.myzen.co.uk

        1 Reply Last reply Reply Quote 0
        • C
          cmb
          last edited by

          Static routes can't and never have influenced IPsec. Just have to make sure you have a P2 with local and remote matching the traffic you want to go over the VPN.

          1 Reply Last reply Reply Quote 0
          • U
            Umberto
            last edited by

            I have fixed the problem, but still I think it's strange why it didn't work.
            What I did is I changed te subnets on pf2, I changed 192.168.41.0/24 to 192.168.140.0/24
            and 192.168.71.0/24 to 192.168.170.0/24.
            After that I did setup 2 tunnels on pf1 192.168.0.0/17 -> 192.168.128.0/17 and on pf2 192.168.128.0/17 -> 192.168.0.0/17
            This works perfect, no outbound nat adjustment needed, every subnet is reachable without changing any thing else on the ipsec settings and firewall rules.(they were allready setup right)
            In the old situation I had high pings and package loss (both pf's where connected with a cable of about 300meter) after the change ping was <1ms and no package loss anymore.

            What could this be? Some bad routing?

            1 Reply Last reply Reply Quote 0
            • First post
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.