Hello OPNsense Team,
I migrated my IPsec tunnels and the firewall rules in new methods and currently I have OPNsense version 26.1.11_10. I was using the legacy IPsec implementation, but I have now migrated to the new IPsec connections.
The migration was successful, and all of my IPsec tunnels are working correctly. However, I have a question regarding firewall rules.
I understand that for Phase 2, I can create firewall rules on the automatically created IPsec virtual interface, and those rules are working as expected. What confuses me is Phase 1. I have searched throughout the OPNsense interface but could not find any firewall rule or setting specifically related to Phase 1.
Since the tunnels establish successfully and traffic is passing normally, I am wondering:
Are there no firewall rules required for IPsec Phase 1 in the new IPsec implementation?
If so, how is IKE (Phase 1) traffic being handled internally?
Is there a dedicated location where Phase 1 rules are managed, or is this behavior expected?
I would appreciate it if someone could clarify how Phase 1 traffic is handled in the new IPsec connections implementation.
Thank you!
Opnsense has a default allow rule (Let out anything from firewall itself).
That means initiated connections always succeed.
But you will have issues if the other peer tries to communicate with your Ipsec Daemon (eg send a command to tear the tunnel down and reauthenticate) so I would suggest creating inbound allow rules for Phase 1 as well.