Show Posts
1
17.1 Legacy Series / Disappointed by IPSec management
« on: March 09, 2017, 04:09:02 pm »
Hello,
I'm trying to replace our pfSense and I've just try OPNsense.
I state that the IPsec management does NOT work as it should.
I have about 30 tunnels, just several ones are up after switching to OPNsense.
After some digging I understand that:
- all IPsec tunnels with NAT (at my side) do not work at all, the packets are send non encrypted to Internet, there is no Phase 2 negotiations at all;
- very often the modifications in Phase 2 destinations do not work, there is no changes in system route table (old route is still here, new one is not added), this problem is randomly present;
- when I force BINAT - it complains about the difference in network masks between my LAN network and translated network, but I'm sure to use the same network mask.
It's really damage, but I must go back to my pfSense.
I'm trying to replace our pfSense and I've just try OPNsense.
I state that the IPsec management does NOT work as it should.
I have about 30 tunnels, just several ones are up after switching to OPNsense.
After some digging I understand that:
- all IPsec tunnels with NAT (at my side) do not work at all, the packets are send non encrypted to Internet, there is no Phase 2 negotiations at all;
- very often the modifications in Phase 2 destinations do not work, there is no changes in system route table (old route is still here, new one is not added), this problem is randomly present;
- when I force BINAT - it complains about the difference in network masks between my LAN network and translated network, but I'm sure to use the same network mask.
It's really damage, but I must go back to my pfSense.