4

I have a pfsense box (Call this BOX1) that has LANs and a WAN which connects to the internet and is used to create a VPN connection to a client: This has pfsense version 2.0.2-RELEASE (i386)

I have a another pfsense box (Call this BOX2) with an Internet Connection. Behind it is several LANs (LANx): This has pfsense version 2.1-RELEASE (i386)

There is also a Point to Point Connection between BOX1 and BOX2

BOX2 uses BOX1 as its default gateway.

This means BOX1 is the default gateway for its own LAN and also the default gateway for BOX2 and the networks behind BOX2.

The internet of BOX2 is normally used only when BOX1's WAN is unreachable.

BOX1 has got a site to site VPN to a client who use that VPN to connect to an IP 192.168.2.5 (Call it SRV1) which sits in the LAN behind BOX1.

Using the WAN on BOX2, I want to setup a backup VPN to the client so that they can connect to SRV1 via the Point to Point that connects BOX2 and BOX1. The client's computer is on IP: 172.16.2.10

Basically, if the WAN supporting the VPN on the PfSense BOX1 is down, I want the clients themselves to switch to VPN2 which will connect via the Point to Point link to BOX1 and thus find SRV1 which sits behind BOX1.

Can you guide me on how to do this kind of setup?

http://postimg.org/image/95ha0l0x1/

So far, I have tried but haven't succeeded. On BOX2, am getting the errors:

Jan 30 10:32:04 racoon: [Unknown Gateway/Dynamic]: ERROR: such policy already exists. anyway replace it: 172.16.2.10/24[0] 10.10.11.3/32[0] proto=any dir=in

Jan 30 10:32:04 racoon: [Unknown Gateway/Dynamic]: DEBUG: db :0x28501288: 172.16.2.10/24[0] 10.10.11.3/32[0] proto=any dir=in

Jan 30 10:32:04 racoon: [Unknown Gateway/Dynamic]: DEBUG: sub:0xbfbfe724: 172.16.2.10/24[0] 10.10.11.3/32[0] proto=any dir=in

Jan 30 10:32:04 racoon: DEBUG: got pfkey X_SPDADD message

Jan 30 10:32:04 racoon: DEBUG: pk_recv: retry[0] recv()

Jan 30 10:32:04 racoon: [Unknown Gateway/Dynamic]: ERROR: such policy already exists. anyway replace it: 192.168.2.5/32[0] 172.16.2.10/24[0] proto=any dir=out

Jan 30 10:32:04 racoon: [Unknown Gateway/Dynamic]: DEBUG: db :0x28501508: 192.168.2.5/32[0] 172.16.2.10/24[0] proto=any dir=out

Jan 30 10:32:04 racoon: [Unknown Gateway/Dynamic]: DEBUG: sub:0xbfbfe724: 192.168.2.5/32[0] 172.16.2.10/24[0] proto=any dir=out

Jan 30 10:32:04 racoon: [Unknown Gateway/Dynamic]: DEBUG: db :0x28501288: 172.16.2.10/24[0] 10.10.11.3/32[0] proto=any dir=in

Jan 30 10:32:04 racoon: [Unknown Gateway/Dynamic]: DEBUG: sub:0xbfbfe724: 192.168.2.5/32[0] 172.16.2.10/24[0] proto=any dir=out

Jan 30 10:32:04 racoon: DEBUG: got pfkey X_SPDADD message

Jan 30 10:32:04 racoon: DEBUG: pk_recv: retry[0] recv()

Jan 30 10:32:04 racoon: INFO: unsupported PF_KEY message REGISTER

Jan 30 10:32:04 racoon: DEBUG: got pfkey REGISTER message

Jan 30 10:32:04 racoon: DEBUG: pk_recv: retry[0] recv()

Jan 30 10:32:04 racoon: DEBUG: getsainfo params: loc='192.168.2.5' rmt='172.16.2.10/24' peer='NULL' client='NULL' id=1

Jan 30 10:32:04 racoon: DEBUG: no check of compression algorithm; not supported in sadb message.

Jan 30 10:32:04 racoon: DEBUG: hmac(modp1536)

Jan 30 10:32:04 racoon: DEBUG: reading config file /var/etc/ipsec/racoon.conf

Jan 30 10:32:04 racoon: DEBUG: pk_recv: retry2 recv()

Jan 30 10:32:04 racoon: DEBUG: pk_recv: retry1 recv()

Jan 30 10:32:04 racoon: DEBUG: pk_recv: retry[0] recv()

Jan 30 10:32:04 racoon: [Unknown Gateway/Dynamic]: DEBUG: db :0x28501288: 172.16.2.10/24[0] 10.10.11.3/32[0] proto=any dir=in

Jan 30 10:32:04 racoon: [Unknown Gateway/Dynamic]: DEBUG: sub:0xbfbfe704: 192.168.2.5/32[0] 172.16.2.10/24[0] proto=any dir=out

Jan 30 10:32:04 racoon: DEBUG: got pfkey X_SPDDUMP message

Jan 30 10:32:04 racoon: DEBUG: pk_recv: retry[0] recv()

Jan 30 10:32:04 racoon: DEBUG: got pfkey X_SPDDUMP message

Jan 30 10:32:04 racoon: DEBUG: pk_recv: retry[0] recv()

Jan 30 10:32:04 racoon: INFO: unsupported PF_KEY message REGISTER

Jan 30 10:32:04 racoon: DEBUG: got pfkey REGISTER message

Jan 30 10:32:04 racoon: DEBUG: pk_recv: retry[0] recv()

I'd posted this question on pfsense forums but shortly after I remembered am an active SE member so I came looking for a network forum. Hope that doesn't break any rules

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 31, 2020 at 5:16

1 Answer 1

Reset to default
1

It seems that you are using NAT instead of routing between BOX1 and BOX2. BOX2 needs to know how to reach the network behind BOX1. You can either configure static routes, or you can run a routing protocol between the two routers.

Routers learn routes in three ways:

  1. Routers inherently know about directly connected networks
  2. Statically through manual configuration
  3. Dynamically through a routing protocol

Static route configuration does not scale, but it may not be a problem in such a small network. You should not use NAT inside your network, only on the interfaces to the public Internet. Inside your network, just use routing, but you will somehow need to let BOX1 know about any networks behind BOX2, and vice versa. You can configure static routes on each router to do that, but you will need to shut down the NAT on the point-to-point link.

Improve this answer
2
  • Do you think he still needs an answer after almost 7 years??..I hope he doesn't.. it would kind of break my spirit to be stuck for 7 years on a setup issue🙈
    – manish ma
    Commented Dec 16, 2020 at 19:10
  • 2
    It’s not really just about the OP. Remember that SE sites are not help sites, they are archives of questions and answers. The idea is that if someone has a question, others may have the same question and can find the answer.
    – Ron Maupin ♦
    Commented Dec 16, 2020 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.