Ipsec and gateways

thorolason

I'm Setting up ipsec on one of your firewalls. I have ipsec running fine with stable results on other firewalls.

What is special with this setup is that I have 2 gateways on the WAN interface. This is actually only to access the test environment, when in production I will only have 1 gateway.

The problem arises that every time some ipsec configuration is done or ipsec restartet then pfsense adds a static host route to the default gw for the connection.

I however dont want to use the default gw but the other gateway as stated in my routing table.
Deleting the auto added static route to the default gateway replacing it with a host route works sometimes and sometimes not !

i.e.
normal routing table before ipsec started. (ip ar changed)

default 100.101.102.217 UGS 0 120402057621 ix3
200.201.202.176/29 100.101.102.220 UGS 0 165912 ix3
200.201.202.178/32 100.101.102.220 UGS 0 1773 ix3

after starting ipsec a host route is added automaticly to the default gw
default 100.101.102.217 UGS 0 120402057621 ix3
200.201.202.176/29 100.101.102.220 UGS 0 165912 ix3
200.201.202.178 100.101.102.217 UGHS 0 11 ix3 =>
200.201.202.178/32 100.101.102.220 UGS 0 1773 ix3

after deleting the auto added route the tunnel sometimes works and somtetime does not

default 100.101.102.217 UGS 0 120402057621 ix3
200.201.202.176/29 100.101.102.220 UGS 0 165912 ix3
200.201.202.178/32 100.101.102.220 UGS 0 1773 ix3

cheers / Thor

thorolason

Right so I figured out why it was sometimes working and sometimes not.

When I do confguration changes to ipsec - pfsense removes my static host route and replaces it with own.
i.e after I do configuration changes to ipsec i have to:
make a new static route
delete the static route pfsense automatically added.

In case of just restarting ipsec pfsense does not delete my static route
i.e after restarting racoon i just need to purge the route pfsense added during the racoon restart.

Ok workaround for my test setup, but it would be preferable if possible to define a gateway e.g. in the phase1 configuration.

Cheers / Thor