NAT-T between two 2.2 pfsense with public IP. Why?

  • Hi,

    not really a problem, since my tunnels are up and running, but I observed that even with two public IP (on both firewalls), the tunnel shows up as NAT-T configured.

    Description 	Local ID 	Local IP 	Remote ID 	Remote IP
    left to right 	A.A.A.A 	A.A.A.A		B.B.B.B		B.B.B.B
    				Port: 4500			Port: 48866

    Any idea why?


  • Same here.

    The situation is easily reproduced, between two firewalls running pfSense v2.2-RELEASE with Auto-matic NAT-T option.

    Although performance isn't critical in my case, wrong NAT detection is quite annoying.

  • Banned

    Known bug, wait for 2.2.1

  • @dusan:

    wrong NAT detection is quite annoying.

    It's not wrong NAT detection, except the text in the status page. I'm guessing you're using IKEv2, where it's MOBIKE, not NAT-T. MOBIKE wasn't controllable until 2.2.1, and it defaults to on in strongswan. Now we default it to off, since most use cases are site to site, not mobile, but make it configurable. We also hide the NAT-T field in the GUI where IKEv2 is chosen now, to make it more clear when it's applicable.

    The status page text where it shows "NAT-T", it just spits that out if it's using port 4500 (it was a quick hack I put in to fix a problem with it not showing), so it's actually wrong in that case.

    You're using MOBIKE, because it's configured to do so.

  • cmb, thank you for information. Yes, I'm using IKEv2, for security. I didn't know that switching to IKEv2 also [accidentally] activates MOBIKE.  It doesn't seem to have been mentioned in the 2.2 release notes.

    From pftop status display (below), I can confirm that ESP tunnels between pfSense firewalls with public IP addresses remain pure ESP, not UDP-tunneled. It's just the IPsec status page that displays misleading information.

    Thanks again!

    pfTop: Up State 1-100/17675, View: default, Order: dest. port
    PR    D SRC                   DEST                 STATE   AGE   EXP  PKTS BYTES
    esp   I      2:2  38661    59 8936K 8989M
    esp   O      2:2  41009    60  228K   40M
    tcp   I      10:10   106    11   491  340K
    tcp   O      10:10   106    11   491  340K
    tcp   I      4:4  39727 86274   194 20994
    tcp   I      4:4  37625 84775   186 19694
    udp   I            1:2     15    15     2   352
    udp   I            1:2     12    18     2   276
    udp   I       1:2      7    23     2   152

Log in to reply