Messages

Mmmh. Did you check all three boxes ?

Looks good.

Are any messages in

Code Select Expand

cat /var/log/configd/latest.log

Could you post the output of

Code Select Expand

ls -la /usr/local/etc/swanctl/

I could imagine that this is the reason:

P.S. why the IPEC service doesn't start automatically .. i need to run the command /usr/local/sbin/ipsec start from shell for have the service up and running

Your should restart your box disable and re-enable ipsec and then check if the configuration is written to the file system.

Did you also check the "Enable IPsec" box ?   ( VPN: IPsec: Tunnel Settings )

I'll say that in your certificate the SAN-DNS entry is missing. This is mine.

X509v3 Subject Alternative Name:
                DNS:vpn.mydomain.com
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, 1.3.6.1.5.5.8.2.2

Could you please post

Code Select Expand

cat /usr/local/etc/swanctl/swanctl.conf | grep local_ts
only to check if this is really 0.0.0.0/0

... and please: X509v3 extensions" ( System -> Trust -> Certificates ) of your server certificate.

Can you do a tcpdump on the console ?

tcpdump -vvni <wan interface> host 192.168.10.200 and host 93.66.66.180

Could you please post "Signature Algorithm" and "X509v3 extensions" ( System -> Trust -> Certificates ) of your server certificate.
And you ipsec.log beggining with "received packet: from "

Could you post the details of the entries ...

Not really helpful.  :(
Maybe this is better.

netsh trace start WFP-IPsec per=yes maxsize=0 filemode=single

Maybe there is an issue with your certificates. Please run a trace.

Netsh trace start VpnClient per=yes maxsize=0 filemode=single

.... connection test ...

Netsh trace stop

The trace file file can be read with the Event Viewer. Use filter RRAS-Provider .

Please remove.
- VPN > IPsec > Mobile Clients
  Virtual IPv4 Address Pool  : 192.168.100.0/24
The IP address should be provided by the Radius server

- VPN > IPsec > Tunnel Settings ( phase 2 )
   Type : LAN Subnet
Enter Network and 0.0.0.0/0 here

 Firewall > Rules > WAN
   open ports 500 and 4500 tpc/udp ipv4

You need to open 500 and 4500 only for UDP, but the ESP rule is missing.

Es gibt aus meiner Sicht im Moment mehrere Probleme mit IPsec unter 23.1 und "Connections[new]". Die Phase1 und Phase2 Timeout-Werte für IKEv1- und IKEv2-Tunnel werden aus den GUI-Einstellungen nicht übernommen, so dass hier die Tunnel nur mit den Standard-Werten von stringswan laufen. https://github.com/opnsense/core/issues/6370
Ich habe auch noch keine Möglichkeit gesehen manuelle SPD-Einträge zu pflegen. Insofern habe ich nur ein paar Test-Systeme auf 23.1 und "Connections[new]" migriert und warte mit meinen produktiven Systemen darauf, dass die Fehler behoben werden.