Firewall blocked traffic when I switched from IPSec to OpenVPN

ttblum

Hello,

I just tried to replace an IPSec tunnel between two sites, creating an OpenVPN tunnel to use instead.

The new OpenVPN tunnel came up OK, stats were showing a byte count in both directions.

I could pass traffic OK from the remote side to the local side, but no traffic would pass in the other direction, from the local to the remote site. Let's represent the local site's subnet as 192.168.xx.0/24, and the remote site's subnet as 192.168.yy.0/24.

Even though I have 192.168.xx.0/24 clearly allowed on the remote router's OpenVPN rules, I'm still logging it as being blocked when I run the 'tcpdump -n -e -ttt -i pflog0' command on the remote router:


00:00:00.000000 rule 5/0(match): block in on ovpnc8: 192.168.xx.43 > 192.168.yy.76: ICMP echo request, id 1, seq 73, length 40
00:00:04.502543 rule 5/0(match): block in on ovpnc8: 192.168.xx.43 > 192.168.yy.76: ICMP echo request, id 1, seq 74, length 40
00:00:04.991874 rule 5/0(match): block in on ovpnc8: 192.168.xx.43 > 192.168.yy.76: ICMP echo request, id 1, seq 75, length 40
00:00:05.011338 rule 5/0(match): block in on ovpnc8: 192.168.xx.43 > 192.168.yy.76: ICMP echo request, id 1, seq 76, length 40

How can this be? I did leave the old IPSec tunnel config there on both sides, but I set it to disabled and changed Phase2 to a different subnet to avoid routing conflicts. I'm glad I did because I used this to fail back.

chris4916

I would be curious to have a look at FW rules one each side ;)