1

We have pfSense 2.60 with one ip public

We have a working ipsec tunnel to a customer FortiGate

I need to be able to force routing of packets to/from 10.68.245.200/29 via ipsec interface

we cannot ping 10.68.245.201 from pfSense shell and customer's IT service is NOT blocking pings

Narrowed question: What step should I do to be route traffic to/from 10.68.245.200/29 via ipsec ?

More general goal: I need all traffic from every and each hosts directed to 10.68.245.200/29 must be routed via ipsec tunnel.

I was supposing to find IPSec as interface to be used as a gateway, but in the route definition panel I can see only WAN, LAN1 and LAN2, no ipsec.

All other traffic must be routed (as actually) via WAN

EDIT 1:

I cannot use VTI, because 3rd party doesn't allow it

EDIT 2:

I cannot change the customer's policy about phase 2.

I need to resolve only by my side

  • I have to force traffic to be routed to ipsec if target net matches, second,
  • And I must translate ip from local to assigned ips when usin ipsec and/or when target net matches

I have no idea on how to do both.

Please, so, explain my the first: What step should I do to be route traffic to/from 10.68.245.200/29 via ipsec ?

pfSense itself is not able to ping 10.68.245.201 How can I be able to allow pfSense to ping 10.68.245.201 ?

  • I need to exit through ipsec
  • I need to present pfSense using an ipaddress in 10.68.245.192/29
Improve this question

2 Answers 2

Reset to default
2

There are generally two ways to do IPsec site-to-site VPNs:

  • Using Virtual tunnel interfaces (VTI) which Cisco and many others call route-based VPN. You use the natural IP routing mechanism to direct traffic into the VPN, by assigning the tunnel interface as the next hop.
  • Using IKE traffic selectors which Cisco and others call policy-based. You declare which source/destination address range combinations will flow across the VPN as part of the VPN config, rather than using routes.

Do you know which type you have here? If you have the latter (policy based) then that explains the lack of an IPsec interface to use in routing. Instead, you would need to adjust the Phase 2 Entries under the VPN settings and ensure you have one with the local subnet set as 0.0.0.0/0 (i.e. everything) and the remote as 10.68.245.200/29.

Both ends need to agree on the traffic selectors, so if you can't use 0.0.0.0/0 because the other end does not want to send everything from 10.68.245.200/29 to you, you need to split it down to the actual address ranges you are using and ensure the far end mirrors that configuration. If your addresses clash with others the customer needs to be able to route to independently, or you don't have the freedom to configure the traffic selectors on the far end, you have to start thinking about NAT - https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/phase-2-nat.html for the pfSense side.

Improve this answer
7
  • I cannot use VTI, because 3rd party doesn't support it. Could you expand the part about IKE traffice selector? i've a pfSense firewall
    – realtebo
    Apr 21 at 13:50
  • If I use local subnet set as 0.0.0.0/0 , the customer's FW is not accepting phase 2. So I've local subnet as 10.68.245.192/29
    – realtebo
    Apr 21 at 13:51
  • 1
    Added another paragraph to the answer. I assume you're wanting to send traffic from more than just 10.68.245.192/29, i.e. elsewhere in your network?
    – Mintra
    Apr 21 at 14:19
  • Only 2 ip, on 2 different lans, need to comunicate to 10.68.245.200/29
    – realtebo
    Apr 21 at 14:59
  • 1
    Ok I think I understand now. Sounds like you will have to NAT on the pfSense box, yes. I am not sure on the detail until I get a chance to look at my own installation later.
    – Mintra
    Apr 21 at 15:37
0

You simply need to define matching but inverse qualifying policies on each end of the VPN tunnel as shown in these examples:

https://getlabsdone.com/how-to-configure-ipsec-site-to-site-vpn-between-fortigate-and-pfsense/

https://docs.netgate.com/pfsense/en/latest/recipes/ipsec-s2s-psk.html

Improve this answer
12
  • Sorry, as state in the OP, I cannot change the customer's policy about phase 2. But thanks for pointing an alternative
    – realtebo
    Apr 25 at 9:54
  • If you cannot change the phase 2 policy then it will never work without 'hiding' the second network using NAT but you may run afoul of security policies and possible even criminal considerations by doing that.
    – FrameHowitzer
    Apr 25 at 14:16
  • 1
    Ah so then yes you are stuck doing the NAT configuration. More work for you to save them doing the work.
    – FrameHowitzer
    Apr 28 at 0:30
  • 1
    You can leave the question and make a new one if you can't find good documentation on how to do NAT on PFSense. I think it should be well documented. Search for PFSense VPN with IP Overlap. The design for IP overlap is to allow a network on one side of the tunnel or the other to use NAT to overcome the issue of an overlap of the same IP addresses in the protected networks on both ends of the tunnel.
    – FrameHowitzer
    Apr 28 at 15:48
  • 1
    Possible yes, though difficult. Basically without their participation and troubleshooting, you will never know. You have to match their side configuration.
    – FrameHowitzer
    May 1 at 0:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.