[SOLVED] IPsec vpn with ptp

[tbk49]

I want to run a ptp protocol over my IPsec connection. So supposing I have a configuration that looks like this:

- a loopback device with a private /32 ip used for the local ipsec ip
- a policy under children with local and remote pointing to that private ip's network (x.x.x.0/30)
- then add a GRE device and enter the loopback ip under the local address field and the remote ipsec ip of the peer under remote address, with tunnel local and tunnel remote as e.g. y.y.y.1 and y.y.y.2 on another private /30 network

Is that all I need to run gre over the ipsec tunnel?

[Monviech (Cedrik)]

Yeah running GRE over Ipsec with loopback interfaces works. Its mostly the same as e.g., running vxlan over ipsec (minus the bridge)

https://docs.opnsense.org/manual/how-tos/vxlan_bridge.html

[tbk49]

Yeah running GRE over Ipsec with loopback interfaces works. Its mostly the same as e.g., running vxlan over ipsec (minus the bridge)

https://docs.opnsense.org/manual/how-tos/vxlan_bridge.html

VXLAN might be something that comes later, but for now, my test case is very simple. Just IPsec and test gre.

I'm noticing an unusual behaviour where my peer device's gre tunnel is inactive unless I ping it from the opnsense side. This is causing trouble for devices on the peer's lan when trying to contact the lan on the opnsense such as sending traffic out the default gw on the peer because the static route for the opnsense lan is set as the gre interface for gateway.

Is this because I have misconfigured the ipsec tunnel to only "turn on" the ipsec channel when the opnsense firewall has something it wants to send across it, rather than bidirectional/always-on between the two peers?

[Monviech (Cedrik)]

Try if the loopback interfaces can always ping each other through the tunnel.

If thats the case, its not IPsec.

Some ping initiating something either sounds like the tunnel (a tunnel since its two, to be more precise) is not up, a firewall state is missing, or traffic is misrouted.

What exactly it is is very hard to diagnose exactly, I can just offer directions.

[tbk49]

Try if the loopback interfaces can always ping each other through the tunnel.

If thats the case, its not IPsec.

Some ping initiating something either sounds like the tunnel (a tunnel since its two, to be more precise) is not up, a firewall state is missing, or traffic is misrouted.

I have now noticed that the opnsense is giving an address to the client:

Code Select Expand

ipsec got address 10.x.x.1
ipsec got exclusive dns 10.y.y.1

But the subnet the client assigns is incorrect (so could either be an error from opnsense or the client). Also, the client assigns the address to the WAN interface rather than a ptp interface (for use over ipsec).

How do you control what address the client receives or can I configure opnsense to not send one?