Routed IPsec: No IPsec Interface by Gateway settings

[jonsch]

Cheers,

I've two OPNsense firewalls in two different locations, both of them have a public IP and two different LAN subnets.
The routed IPsec is build up like the documentation told me: https://docs.opnsense.org/manual/how-tos/ipsec-s2s-route.html

The IPsec tunnel is up and running, but I can't set the static routes on both firewalls, because there is no option to create a gateway with the IPsec interface? So how should I route the traffic through the tunnel?

Regards,

[mimugmail]

Do you see the new firewall rules tab? IPsec in general is enabled?

[jonsch]

Yes, the IPsec connection is up and running.
The firewall rule table is also been active with an any any route for testing at the moment.

[Gauss23]

There is no interface for IPsec connections. They don´t provide an interface.

Usually you create as much Phase2 entries as needed to route all the networks you want to route between these sites.

[jonsch]

Are you sure? Take a look to the official documentation by step 5 they add an single gateway with an IPsec interface?

I just bind the subnets by phase 2 to the IPsec tunnel but thats all. The routing part has to be created seperate, right? How else should the firewall route the traffic to the IPsec tunnel and not to the default route.

[Gauss23]

Sorry, misunderstood your question.

You need to have "install policy" in Phase1 disabled to be able to use the connection for Gateway creation.

[jonsch]

No problem.
It is still disabled, thats the strange thing.
Any other ideas?

[mimugmail]

Screenshots please, P1, P2, Firewall, Interface

[jonsch]

Other site is configured the same way.
Attached you will find the screenshots.

[jonsch]

and the last one...

[mimugmail]

This is a policy based IPsec, you didnt follow the Guide.
Also dont use special chars in description as this will be the name of interface

[jonsch]

You are right, I have made the phase 2 on a false way.
I have now removed the subnets and add the tunnel source and destination IP.

But there is still now IPsec interface to choose?

[mimugmail]

Also dont use special chars in description as this will be the name of interface

New screenshots please ...

[jonsch]

I have removed also any special characters and white spaces...
The configuration is the same but addresses instead of subnets...

[mimugmail]

You still didn't follow the docs exactly .. it routed and not tunnel ..