Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    IPSEC VPN to Amazon AWS VPC - Traffic not passing

    IPsec
    1
    1
    2625
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • O
      Oddnewfi last edited by

      Hi,

      This is a bit of a pig of a setup - but any ideas appreciated…

      Our Side

      PFSense 2.1- release on physical hardware (Dell 1950) behind a Watchguard Firewall

      Other side

      Amazon VPC VPN End point

      Security

      Rules on Watchguard permit all incoming traffic to PFSense.
      Amazon Security Groups and Network ACLs set to allow all (from our side subnet)

      Behaviour

      From Amazon side host - can connect and establish connection to machine behind pfsense. Tunnels come up and traffic flows.
      Once the tunnel is brought up from the Amazon side - then host on our side can connect to Amazon hosts.

      However. If tunnel is down and our side host wants to connect to Amazon. Tunnel comes up and can see outbound traffic on the SAD bytes counter - but nothing coming back (the return path shows no traffic on the SAD bytes counter)

      Steps so far

      NAT-T off / on - no difference
      DPD off/on - no difference
      Disabled firewall (routing only platform)
      Allow IPV6
      Enable MMS clamping (at 1400)

      Running Racoon in debug mode - and the tunnel doesn't appear to be flapping (can see RU there requests and responses, for example).

      Using exactly the same settings from another machine (without the Watchguard in front) works just fine. So seems like somehow the Watchguard interferes with the traffic on the way out, if the link comes up from our side. Whilst this is not therefore a pfsense problem as such - could anyone point me to any ideas as to why this might be happening

      Many thanks

      1 Reply Last reply Reply Quote 0
      • First post
        Last post

      Products

      • Platform Overview
      • TNSR
      • pfSense
      • Appliances

      Services

      • Training
      • Professional Services

      Support

      • Subscription Plans
      • Contact Support
      • Product Lifecycle
      • Documentation

      News

      • Media Coverage
      • Press
      • Events

      Resources

      • Blog
      • FAQ
      • Find a Partner
      • Resource Library
      • Security Information

      Company

      • About Us
      • Careers
      • Partners
      • Contact Us
      • Legal
      Our Mission

      We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

      Subscribe to our Newsletter

      Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

      © 2021 Rubicon Communications, LLC | Privacy Policy