0

Our company delivers, installs and maintains custom build hardware at customer sites. In all cases the delivered setup contains at least 1 server and 2 network devices. To keep the control over the network, we setup a separated network inside the customers network where all our hardware is connected to by placing an extra router. All "our" customer networks are connected to our office through IPSec connections.

The described setup makes it possible that we can directly access the hardware at the customer site's from our main office. Our firewall blocks requests coming from customer site's into our office network so customers cannot reach any device in our main office. They can also not see devices in other customer networks. So far everything works like intended.

Since a few weeks, we have a new office in Greece which is also connected to our main office via IPSec, the same way as our customer site's are connected. I configured some extra firewall rules at the office site so the other office can access devices inside our main office network. Except for beieng able to access devices in our office, they should also be able to reach customer sites. I tried to set a route inside the Greece office router and tried to set some customer route's in our main office but i cannot get it working.

We use pfSence at our main office and currently an Edgerouter at the Greece office (i know ER its not supported on this exchange but my question is not about Edgerouter specifically). The idea is that the devices in the Greece office connect to our customer networks via our main office. We also don't want to do "Greece specific configurations" for each new customer.

enter image description here

I read this and understand the theorie but was not able to bring it in practice.

Network

  • Main office: 10.128.10.0/24
  • Customer networks: 10.130.x.0/24 (where x differs per customer)
  • Greece office network: 10.130.2.0/24

What i tried:

  • Set a route at the Greece office router: 10.130.0.0/16 via 10.128.10.1
  • Set a route at the main office: 10.130.0.0/16 via 10.128.10.1 (as i can reach customer networks from this network)
  • Allow all traffic (and protocols) from 10.130.2.0/24 to all "any" networks

I hope i mentioned all required information, if not let me know! I'm a software engineer, not a network engineer ;-)


UPDATE 1:

This is how the IPSec connection is configured (at the main office).

<phase1>
    <ikeid>5</ikeid>
    <iketype>ikev2</iketype>
    <interface>wan</interface>
    <remote-gateway>domain.no-ip.org</remote-gateway>
    <protocol>inet</protocol>
    <myid_type>myaddress</myid_type>
    <myid_data></myid_data>
    <peerid_type>fqdn</peerid_type>
    <peerid_data>domain.no-ip.org</peerid_data>
    <encryption>
        <item>
            <encryption-algorithm>
                <name>aes</name>
                <keylen>128</keylen>
            </encryption-algorithm>
            <hash-algorithm>sha256</hash-algorithm>
            <dhgroup>14</dhgroup>
        </item>
    </encryption>
    <lifetime>28800</lifetime>
    <pre-shared-key>Some_Key_Here</pre-shared-key>
    <private-key></private-key>
    <certref></certref>
    <caref></caref>
    <authentication_method>pre_shared_key</authentication_method>
    <descr><![CDATA[Some IP Sec connection]]></descr>
    <nat_traversal>on</nat_traversal>
    <mobike>off</mobike>
    <closeaction></closeaction>
    <margintime></margintime>
    <responderonly></responderonly>
</phase1>


<phase2>
    <ikeid>5</ikeid>
    <uniqid>5efc4de77ba1a</uniqid>
    <mode>tunnel</mode>
    <reqid>1</reqid>
    <localid>
        <type>network</type>
        <address>10.128.0.0</address>
        <netbits>16</netbits>
    </localid>
    <remoteid>
        <type>network</type>
        <address>10.130.4.0</address>
        <netbits>24</netbits>
    </remoteid>
    <protocol>esp</protocol>
    <encryption-algorithm-option>
        <name>aes</name>
        <keylen>128</keylen>
    </encryption-algorithm-option>
    <encryption-algorithm-option>
        <name>aes128gcm</name>
        <keylen>128</keylen>
    </encryption-algorithm-option>
    <hash-algorithm-option>hmac_sha256</hash-algorithm-option>
    <pfsgroup>14</pfsgroup>
    <lifetime>3600</lifetime>
    <pinghost>10.130.4.1</pinghost>
    <descr><![CDATA[axn_int to external]]></descr>
</phase2>

It also represents the configuration at the customer site's. The customer site has 10.130.4.0/24 as local network and 10.128.0.0/16 as remote network. Do i understand correctly that i also need to add a second Phase 2 like:

  • Customer site:
    • local 10.130.4.0/24
    • remote 10.130.0.0/16
  • Main office
    • local 10.130.0.0/16
    • remote 10.130.4.0/24

Or do "just" need to add routes at the customer devices like:

  • 10.130.0.0/16 via 10.128.10.1
5
  • 1
    You seem to forget that most network protocols are bidirectional, so the other offices will need to have a route back to the Greece office for any replies to make it back to Greece.
    – Ron Maupin
    Sep 8 '20 at 11:57
  • We would really heed to see the router configurations. This has to do with routing, not the VPN.
    – Ron Maupin
    Oct 7 '20 at 13:03
  • Routing from which site? - Routing at the main office is managed by pfSense. There are no static routes configured. I would like to share the router config with you all but the export is very long. Can you specify a bit more wat you need? e.g. firewall rules, static routes, interfaces, nat - Currently also no static routes are configured at the customer site's or the Greece office though i think its required to set a route there like 10.130.0.0/16 via 10.128.10.0/24 as its possible to reach 10.128.10.1 from other site's when i allow it by adjusting the firewall rule
    – CodeNinja
    Oct 7 '20 at 13:50
  • Start with the configuration of one of the remote routers that needs to reach Greece and the Greece router. You have 30,000 characters for your question. Please use the Preformatted-text option ({}).
    – Ron Maupin
    Oct 7 '20 at 14:25
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 17 '20 at 21:19
2

The other remote sites need to know how to reach the Greece router for return traffic.

Depending on how the routing is configured, you either need to add a route on every router to reach the Greece router, or add a default route back to the main office.

1
  • I updated my question so it contains some more information about the IPSec configuration. I already tried different different ways to "route" the traffic correctly but i don't know where to configure the routes exactly. At the customer site? At the office site? (maybe both?) - I also don't know if an additional phase 2 is required, i hope not as it will open extra connections and is extra configuration work on both sites
    – CodeNinja
    Oct 7 '20 at 8:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.