Access IPSec site from another IPSec site

Question

Our company delivers, installs and maintains custom build hardware at customer sites. In all cases the delivered setup contains at least 1 server and 2 network devices. To keep the control over the network, we setup a separated network inside the customers network where all our hardware is connected to by placing an extra router. All "our" customer networks are connected to our office through IPSec connections.

The described setup makes it possible that we can directly access the hardware at the customer site's from our main office. Our firewall blocks requests coming from customer site's into our office network so customers cannot reach any device in our main office. They can also not see devices in other customer networks. So far everything works like intended.

Since a few weeks, we have a new office in Greece which is also connected to our main office via IPSec, the same way as our customer site's are connected. I configured some extra firewall rules at the office site so the other office can access devices inside our main office network. Except for beieng able to access devices in our office, they should also be able to reach customer sites. I tried to set a route inside the Greece office router and tried to set some customer route's in our main office but i cannot get it working.

We use pfSence at our main office and currently an Edgerouter at the Greece office (i know ER its not supported on this exchange but my question is not about Edgerouter specifically). The idea is that the devices in the Greece office connect to our customer networks via our main office. We also don't want to do "Greece specific configurations" for each new customer.

I read this and understand the theorie but was not able to bring it in practice.

Network

• Main office: 10.128.10.0/24
• Customer networks: 10.130.x.0/24 (where x differs per customer)
• Greece office network: 10.130.2.0/24

What i tried:

• Set a route at the Greece office router: 10.130.0.0/16 via 10.128.10.1
• Set a route at the main office: 10.130.0.0/16 via 10.128.10.1 (as i can reach customer networks from this network)
• Allow all traffic (and protocols) from 10.130.2.0/24 to all "any" networks

I hope i mentioned all required information, if not let me know! I'm a software engineer, not a network engineer ;-)

---

UPDATE 1:

This is how the IPSec connection is configured (at the main office).

<phase1>
    <ikeid>5</ikeid>
    <iketype>ikev2</iketype>
    <interface>wan</interface>
    <remote-gateway>domain.no-ip.org</remote-gateway>
    <protocol>inet</protocol>
    <myid_type>myaddress</myid_type>
    <myid_data></myid_data>
    <peerid_type>fqdn</peerid_type>
    <peerid_data>domain.no-ip.org</peerid_data>
    <encryption>
        <item>
            <encryption-algorithm>
                <name>aes</name>
                <keylen>128</keylen>
            </encryption-algorithm>
            <hash-algorithm>sha256</hash-algorithm>
            <dhgroup>14</dhgroup>
        </item>
    </encryption>
    <lifetime>28800</lifetime>
    <pre-shared-key>Some_Key_Here</pre-shared-key>
    <private-key></private-key>
    <certref></certref>
    <caref></caref>
    <authentication_method>pre_shared_key</authentication_method>
    <descr><![CDATA[Some IP Sec connection]]></descr>
    <nat_traversal>on</nat_traversal>
    <mobike>off</mobike>
    <closeaction></closeaction>
    <margintime></margintime>
    <responderonly></responderonly>
</phase1>


<phase2>
    <ikeid>5</ikeid>
    <uniqid>5efc4de77ba1a</uniqid>
    <mode>tunnel</mode>
    <reqid>1</reqid>
    <localid>
        <type>network</type>
        <address>10.128.0.0</address>
        <netbits>16</netbits>
    </localid>
    <remoteid>
        <type>network</type>
        <address>10.130.4.0</address>
        <netbits>24</netbits>
    </remoteid>
    <protocol>esp</protocol>
    <encryption-algorithm-option>
        <name>aes</name>
        <keylen>128</keylen>
    </encryption-algorithm-option>
    <encryption-algorithm-option>
        <name>aes128gcm</name>
        <keylen>128</keylen>
    </encryption-algorithm-option>
    <hash-algorithm-option>hmac_sha256</hash-algorithm-option>
    <pfsgroup>14</pfsgroup>
    <lifetime>3600</lifetime>
    <pinghost>10.130.4.1</pinghost>
    <descr><![CDATA[axn_int to external]]></descr>
</phase2>

It also represents the configuration at the customer site's. The customer site has 10.130.4.0/24 as local network and 10.128.0.0/16 as remote network. Do i understand correctly that i also need to add a second Phase 2 like:

• Customer site:
  • local 10.130.4.0/24
  • remote 10.130.0.0/16
• Main office
  • local 10.130.0.0/16
  • remote 10.130.4.0/24

Or do "just" need to add routes at the customer devices like:

• 10.130.0.0/16 via 10.128.10.1

Answer 1

The other remote sites need to know how to reach the Greece router for return traffic.

Depending on how the routing is configured, you either need to add a route on every router to reach the Greece router, or add a default route back to the main office.