IPSEC VPN to Amazon AWS VPC - Traffic not passing
This is a bit of a pig of a setup - but any ideas appreciated…
PFSense 2.1- release on physical hardware (Dell 1950) behind a Watchguard Firewall
Amazon VPC VPN End point
Rules on Watchguard permit all incoming traffic to PFSense.
Amazon Security Groups and Network ACLs set to allow all (from our side subnet)
From Amazon side host - can connect and establish connection to machine behind pfsense. Tunnels come up and traffic flows.
Once the tunnel is brought up from the Amazon side - then host on our side can connect to Amazon hosts.
However. If tunnel is down and our side host wants to connect to Amazon. Tunnel comes up and can see outbound traffic on the SAD bytes counter - but nothing coming back (the return path shows no traffic on the SAD bytes counter)
NAT-T off / on - no difference
DPD off/on - no difference
Disabled firewall (routing only platform)
Enable MMS clamping (at 1400)
Running Racoon in debug mode - and the tunnel doesn't appear to be flapping (can see RU there requests and responses, for example).
Using exactly the same settings from another machine (without the Watchguard in front) works just fine. So seems like somehow the Watchguard interferes with the traffic on the way out, if the link comes up from our side. Whilst this is not therefore a pfsense problem as such - could anyone point me to any ideas as to why this might be happening