Author Topic: Why does source = IPsec net not work in my case? (Read 678 times)

Evert · « **on:** February 28, 2024, 10:23:23 am »

Hi all,

I've been configuring an IPsec connection between us, and one of our customers. IPsec itself was working pretty soon (both phase 1 & phase 2), but we had the hardest time pushing bits and bytes through that tunnel...

After trying many things I ended up going to Firewall: Rules: IPsec and changing the source of the rules, which was set to 'IPsec net', to '*'. As soon as I did this, the customer was able to connect to the resources.

We have various other subnets, including 2 Wireguard, where I've set the source to '[subnet name] net' in firewall rules, and this works flawlessly.

Why doesn't this work for our IPsec setup? Did I misconfigure something somewhere, or is this a bug... ahem... feature?

Patrick M. Hausen · « **Reply #1 on:** February 28, 2024, 10:59:05 am »

"IPsec net" is the network directly connected to the tunnel interface, not the remote networks of your customer.

Evert · « **Reply #2 on:** February 28, 2024, 12:05:07 pm »

Ah, ok.

What if I replace '*' with an alias containing the networks of our customer? Would that be a functioning compromise?

Patrick M. Hausen · « **Reply #3 on:** February 28, 2024, 12:40:57 pm »

Yes, most probably.

Evert · « **Reply #4 on:** March 05, 2024, 08:48:24 am »

Before I make the same mistake twice... It would work with Wireguard, right? That's different in this aspect from IPsec?

Author Topic: Why does source = IPsec net not work in my case? (Read 678 times)

Evert

Why does source = IPsec net not work in my case?

Patrick M. Hausen

Re: Why does source = IPsec net not work in my case?

Evert

Re: Why does source = IPsec net not work in my case?

Patrick M. Hausen

Re: Why does source = IPsec net not work in my case?

Evert

Re: Why does source = IPsec net not work in my case?