1
Virtual private networks / Route from OpenVPN (ovpns2) to policy-based IPSec (enc0)
« on: December 12, 2021, 04:06:40 pm »
Hello folks,
just registered in the forum, since I have a problem, which I did not manage to solve yet, even after hours of googling.
First of all I will give some background about my setup:
Site A: Azure Cloud (Azure VPN Gateway) 172.16.0.0/16
Site B: Central VPN Aggregator with OPNSense (no dedicated VPN network, VPN router only)
Site C: Branch Office with pfSense Router 10.13.42.0/24
Here is how the sites are be connected)
SiteA (172.16.0.0/16) <--- IPSec ---> SiteB <--- OpenVPN ---> SiteC (10.13.42.0/24)
The networks 172.16.0.0/16 and 10.13.42.0/24 are not configured as LAN on SiteB but only in the IPSec and OpenVPN config accordingly.
My goal is that clients from 172.16.0.0/16 can reach clients in 10.13.42.0/24 and vica versa via the central VPN aggregator (SiteB)
The VPNs are established and working but unfortunately the traffic is not routed from the OpenVPN to the policy-based S2S IPSec. To debug the VPN setup (routing), I initiated a ping from a client in Site A (172.16.0.0/16). The ICMP packets are routed as expected at least on the way from SiteA to SiteB to SiteC but getting stuck at SiteB on the way back:
As said, I pinged a client [10.13.42.1 (pfSense Router)] at SiteC from a client in SiteA (172.16.2.4). The packet capture at SiteB looks as follows:
As you can see, the packet reaches SiteC, an according response is sent (echo reply) but then the reply gets stuck a SiteB, since it is not routed to the IPSec VPN to SiteA.
Firewalls for IPSec and OpenVPN are widely open (pass any), so that it is not a firewalling issue. Based on some google research, I added a 2nd phase2 between SiteA and SiteB, so that the internal OpenVPN transfer network (10.1.2.0/30) is known by the IPSec but this does not seem to do the trick. However, not make sense in my opinion anyway.
I am quite confident that the traffic gets stuck on the way back, since the packets (echo reply) is not routed from the OpenVPN to the policy-based site-to-site IPSec between Site B and Site A.
However, I have no idea how to sovle that?
just registered in the forum, since I have a problem, which I did not manage to solve yet, even after hours of googling.
First of all I will give some background about my setup:
Site A: Azure Cloud (Azure VPN Gateway) 172.16.0.0/16
Site B: Central VPN Aggregator with OPNSense (no dedicated VPN network, VPN router only)
Site C: Branch Office with pfSense Router 10.13.42.0/24
Here is how the sites are be connected)
SiteA (172.16.0.0/16) <--- IPSec ---> SiteB <--- OpenVPN ---> SiteC (10.13.42.0/24)
The networks 172.16.0.0/16 and 10.13.42.0/24 are not configured as LAN on SiteB but only in the IPSec and OpenVPN config accordingly.
My goal is that clients from 172.16.0.0/16 can reach clients in 10.13.42.0/24 and vica versa via the central VPN aggregator (SiteB)
The VPNs are established and working but unfortunately the traffic is not routed from the OpenVPN to the policy-based S2S IPSec. To debug the VPN setup (routing), I initiated a ping from a client in Site A (172.16.0.0/16). The ICMP packets are routed as expected at least on the way from SiteA to SiteB to SiteC but getting stuck at SiteB on the way back:
As said, I pinged a client [10.13.42.1 (pfSense Router)] at SiteC from a client in SiteA (172.16.2.4). The packet capture at SiteB looks as follows:
As you can see, the packet reaches SiteC, an according response is sent (echo reply) but then the reply gets stuck a SiteB, since it is not routed to the IPSec VPN to SiteA.
Firewalls for IPSec and OpenVPN are widely open (pass any), so that it is not a firewalling issue. Based on some google research, I added a 2nd phase2 between SiteA and SiteB, so that the internal OpenVPN transfer network (10.1.2.0/30) is known by the IPSec but this does not seem to do the trick. However, not make sense in my opinion anyway.
I am quite confident that the traffic gets stuck on the way back, since the packets (echo reply) is not routed from the OpenVPN to the policy-based site-to-site IPSec between Site B and Site A.
However, I have no idea how to sovle that?