Messages

Apparently the wrong route was chosen on the way back from the tunnel and then the response was eaten by the bridging firewall.

That's the not so well documented setup I inherited. The .99 is there because we didn't want to mess around with our live FW.

Here's one. I hope that helps.
Actually I'm not 100% sure whether or not .99's traffic is passing through .66 or not.

Some more intel:

I see the traffic DC -> GCP coming through in the FW logs on .99. I can also see it in the FW logs within the GCP in the allow-ingress rule I've set up.
I can then also see traffic going back within the GCP but apparently it's lost after that.

The OPNsense VPN Gateway (.99) is not the default gateway (that's .65).

There Azure guide https://docs.opnsense.org/manual/how-tos/ipsec-s2s-route-azure.html had "respond only" in it, that's why.

I was wondering about the /128, too, but I cannot change it.

LAN is the only interface (I deleted the weird OPT1)

Tunnel details for the Azure guide setup

enable policy checked

Here's the original setup that works one-way.

The tunnel has "install policy" checked - without it, I can't ping GCP -> DC.

/edit: only 4 attachments allowed, need to split the post

Can you post screenshots please?

Sure, of what exactly?

The description of your vpn will be name of the ipsec interface. If it's empty you'll have ipsec1000. Just look for the description. If there is no interface you config is not correct.

Thanks for the quick reply! Any idea what might not be "correct"?
And what's the deal with 10.111.1.1 / 10.111.1.2 in the Azure guide? What's their purpose? I'm not quite sure where to put the one on the GCP end.

Additional bit of information: In my actual gateway/FW I see block events for 10.255.255.250 -> x.x.x.111 but not vice versa. Why is that?

If the traffic goes through the tunnel I shouldn't see it here. If it does not, I should not see any. It looks like the request DC -> GCP goes past the firewall but the response does not ...

My default DC gateway/FW is x.x.x.65. The tunnel runs on x.x.x.99

Sadly, the guide has

Step 3 - Set MSS Clamping

(Under Interfaces ‣ IPsec Azure) We will use the following settings:

But there is no such (equivalent) iface - where should it come from? I only have LAN and OPT1 (whatever that is). :/

Plus, there's also an iface "IPSEC1000" in this guide and I have no idea where it comes from.

GCP is route based IPsec, you need a different guide, like Azure

Do you have one you can link?

/edit: https://docs.opnsense.org/manual/how-tos/ipsec-s2s-route-azure.html ?

enc0 is a virtual IPsec interface

Ah thanks, that's what I've thought. Then I'd figure that the ICMP packet comes in, gets routed to the VPN tunnel, a reply comes back but then is lost somewhere? :|