IPSec, LAN's can talk, but not pfsense machines?

Rendrag

Hi Folks,

We have pfsense firewalls in two of our offices (using these two as a proof of concept for our offices in other countries), and I have IPSec setup between the two. The machines on the LAN at each end can talk to each other no problems - but the actual pfsense boxes can't talk to the remote ends?

I have:

End 1:

Remote Gateway: WAN_TPGEFM, 202.1.2.2
Tunnel: Interface LAN, Remote subnet 192.168.21.0/24

End 2:

Remote Gateway: WAN_TPGEFM, 202.1.2.3
Tunnel: Interface LAN, Remote subnet 192.168.22.0/24

I can ping from any machine in 192.168.22.0/24 on End 1 to any machine in 192.168.21.0/24 in End 2
I can also ping from any machine to the firewalls (on .254 on each subnet).

However I cannot ping from the firewalls to hosts on the remote subnets. If I use the pfsense web interface, and select 'LAN' as the interface, I can then ping the remote subnet fine? Should I be adding a manual route somewhere to tell PFsense to talk to the remote subnets via its LAN interface or something?

A little confused :)

cmb

http://doc.pfsense.org/index.php/Why_can%27t_I_query_SNMP,_use_syslog,_NTP,_or_other_services_initiated_by_the_firewall_itself_over_IPsec_VPN%3F

Rendrag

Thanks CMB, that was what I was thinking I might have to do - works great, thanks :)