Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Multiple IPsec Mobile Phase 1 (for multiple WAN interfaces)

    IPsec
    3
    6
    4.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bulgarion
      last edited by

      Hi everybody, and merry Christmas.
      Going straight to business - I have a pfSense load-balancing two ethernet connections, one on the WAN1 interface and the other on the WAN2 interface. Recently I enabled a mobile IPsec tunnel for an iPad, but I can't seem to find the option to add multiple "Mobile Clients" Phase 1 to assign to the multiple interfaces of the firewall (so that I could - with two mobile IPsec configurations - keep connecting to the firewall even if one of the two internet connection goes down).
      Any hint?
      Thanks,

      Marco

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        There isn't a way to make multiple mobile Phase 1's. There can only be a single Mobile instance.

        You could try, if you force NAT-T, to bind it to the LAN and use port forwards for udp/4500, udp/500, and ESP on each WAN to the LAN IP.

        I say force NAT-T because I don't know how well, if at all, IPsec would like that NAT for normal mode.

        Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • B
          bulgarion
          last edited by

          Thanks for the tip - I also force NAT-T (due to the fact that I'm using external routers that both do static NAT to the pfSense, and the external clients are iPhones/iPads), so I'll give it a shot someday.

          Is there any particular reason behind the choice to have a single Mobile Phase 1? Not arguing, just curious. Maybe I could file a feature request for multiple Mobile Phases, or just an option for listening over multiple interfaces.

          1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by

            I believe that's all that the underlying software supports in a way we can actually use.

            It needs specific IPs for site-to-site's and then it can have one "anonymous" (mobile) that isn't tied to a fixed IP. It can't really have multiple catchalls in that way.

            Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • D
              dhatz
              last edited by

              JimP, what about the discussion in http://redmine.pfsense.org/issues/1965 where you wrote:

              In the future it would be nice to have IPsec allow connections to/from multiple peers for the same tunnel, for failover.

              racoon can handle multiple phase 1's in this way, there would just need to be some means in the GUI to allow the input of additional peers.

              1 Reply Last reply Reply Quote 0
              • jimpJ
                jimp Rebel Alliance Developer Netgate
                last edited by

                Completely different animal.

                I had thought it would be simpler but it requires a bit of heavy lifting to make that work. That's why we chose to do the gateway group method instead of that sort of failover.

                Would still be nice to figure out eventually, but a bit beyond my understanding of racoon's config and how we'd have to set it all up. (Plus the other end would have to support it, too)

                Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                Need help fast? Netgate Global Support!

                Do not Chat/PM for help!

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.