[SOLVED] User authentication with LDAP through ipsec tunnel

[jmeyer]

Hello,

I would like to authenticat users through our central LDAP server witch is only reachable through a ipsec tunnel.

I think the authentication go through the wrong (WAN) gateway and is not using the ipsec tunnel. Is it possible to specific the gateway witch should be used for the authentication server?

I'm using opnsense 18.7.10

best regards,
Julian

[guest19757]

Hello there,

Out of curiosity, I haven't looked at the options in the configuration, I wonder if a outbound NAT or routing table modification? This assumes that LDAP is on a different subnet? These are just workaround suggestions.

Regards

[mimugmail]

You could add WAN IP to IPSEC SA or switch to LDAPS via WAN.

[jmeyer]

Hello,

I tried an outbound NAT, a static route and also adding WAN IP to IPSEC SA of the tunnel. Nothing worked.

With the "Diagnostics: Packet Capture" tool I can see that the traffic is going out on my WAN interface.

I had the same issue with the Unbound DNS service and a domain overwrite of a domain through the tunnel. The solution here was to set the "Outgoing Network Interfaces" to my LAN interface.

Is it possible to set the Outgoing Interfaces for authentication servers?

regards

[franco]

IPsec will prohibit this by default for security reasons. The LDAP request needs to come from a Phase 2 left subnet. There's no way to configure this at the moment for authentication purposes.


Cheers,
Franco

[mimugmail]

You could add WAN IP to IPSEC SA or switch to LDAPS via WAN.

I'm doing the first in productin with Cisco at the other side ..

[franco]

Ha, that sounds really cool! 

[jmeyer]

You could add WAN IP to IPSEC SA or switch to LDAPS via WAN.

I'm doing the first in productin with Cisco at the other side ..

Maybe I have done something wrong on the configuration. I will try it again if i'm back in the office. I don't won't to lock me out.

I will give feedback on Friday or monday.

PS: On the other side is currently a pfsense, later this will be an opnsense too.

[jmeyer]

Hi, I just like to confirm, that adding the WAN IP to IPSEC SA is a successfully working solution.