Topics

I've been following along here: https://docs.opnsense.org/manual/how-tos/ipsec-s2s-conn-route.html in order to establish a link between my local networks (OPNSense) and a remote network (Fortigate).

I'm able to pull up the tunnel and see that the interface (Site1Site2) is created.

No traffic is able to pass over the tunnel however.

Code Select Expand

Site1
Local Network: 172.19.0.0/16
VPN Pool 172.16.100.4/30
VPN Address 172.16.100.6


Site2
Local Network: 172.17.0.0/16
VPN Pool 172.16.100.4/30
VPN Address 172.16.100.5
I've enabled logging on the IPV4 <- * * * * * * and IPV4 -> * * * * * * rules in both the Site1Site2 and IPsec firewall tables.

The symptom I'm seeing in the logs is all outbound traffic is going out the Site1Site2 interface, but all the traffic from Site2 is coming in and hitting the IPsec firewall table/interface.

Should these be connected somehow?

I've got what I feel is a properly configured IKEv2 EAP-MSCHAPv2 road warrior setup.

I can connect to it over WAN from any android device as well as a Linux laptop.

I can connect to it over LAN from an iOS device. However, if I try to connect to it via WAN, I get "The VPN server did not respond"

I'm not sure what the issues could be, because android and Linux connect just fine over WAN.

It feels like there is some firewall rule or setting not exposed that needs to be set.

I have followed the RoadWarrior setup here: https://docs.opnsense.org/manual/how-tos/ipsec-road.html

I am able to connect my iPhone (iOS15) to the opnsense VPN gateway, and am given a valid address.

I am not able to reach the internet, the local LAN(s), or the opnsense vpn gateway itself.

Opnsense is not my DNS nor DHCP server, those are handled by a pihole VM elsewhere on the network.

The log file has messages like "querying policy 0.0.0.0/0 === 10.0.0.1/32 out failed, not found" in it, since I replaced the "LAN subnet" described in the documentation with "0.0.0.0/0" as described in a few posts I've seen.

Is there anything else that could be preventing traffic from passing?