IPSec S2S Tunnel problem

[herrnic]

For a few days now I've been racking my brains over an ipsec tunnel connection that doesn't really want to work.

Phase 1 and phase 2 are established but unfortunately I can't reach the other side.

I hope someone here has an idea and can help.

Version: OPNSENSE 21.1.6

Here are the data from ipsec statusall:

Code Select Expand

root@OPNsenseVF:~ # ipsec statusall
no files found matching '/usr/local/etc/strongswan.opnsense.d/*.conf'
Status of IKE charon daemon (strongSwan 5.9.2, FreeBSD 12.1-RELEASE-p16-HBSD, amd64):
  uptime: 11 minutes, since Jun 18 15:32:47 2021
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 5
  loaded plugins: charon aes des blowfish rc2 sha2 sha1 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf curve25519 xcbc cmac hmac gcm drbg attr kernel-pfkey kernel-pfroute resolve socket-default stroke vici updown eap-identity eap-md5 eap-mschapv2 eap-radius eap-tls eap-ttls eap-peap xauth-generic xauth-eap xauth-pam whitelist addrblock counters
Listening IP addresses:
  192.168.22.100 (opnsense)
  192.168.10.198 (WAN)
Connections:
        con1:  192.168.10.198...85.1.2.3  IKEv2
        con1:   local:  [192.168.10.198] uses pre-shared key authentication
        con1:   remote: [85.1.2.3] uses pre-shared key authentication
        con1:   child:  213.1.2.3/32 === 139.1.2.3/32 TUNNEL
Security Associations (1 up, 0 connecting):
        con1[4]: ESTABLISHED 8 minutes ago, 192.168.10.198[192.168.10.198]...85.1.2.3[85.1.2.3]
        con1[4]: IKEv2 SPIs: c829b25a6dd28deb_i* cacc8476f40761cb_r, pre-shared key reauthentication in 2 hours
        con1[4]: IKE proposal: AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/ECP_384
        con1{2}:  INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c843ae3b_i 26d84c90_o
        con1{2}:  AES_CBC_256/HMAC_SHA2_256_128, 0 bytes_i, 0 bytes_o, rekeying in 37 minutes
        con1{2}:   213.1.2.3/32 === 139.1.2.3/32


Normally I should be able to reach 139.1.2.3 via telnet when the connection is established.


I notice this message in the log files.

Code Select Expand

charon[16026] 12[KNL] <con1|1> querying policy 213.1.2.3/32 === 139.1.2.3/32 out failed, not found

I cannot interpret these correctly.
Is it just a routing problem?

Here is netstat:

Code Select Expand

root@OPNsenseVF:~ # netstat -rn
Routing tables

Internet:
Destination        Gateway            Flags     Netif Expire
default            192.168.10.2       UGS      vtnet1
1.1.1.1            8e:f7:81:14:be:93  UHS      vtnet1
8.8.4.4            8e:f7:81:14:be:93  UHS      vtnet1
127.0.0.1          link#4             UH          lo0
192.168.10.0/24    link#2             U        vtnet1
192.168.10.198     link#2             UHS         lo0
192.168.22.0/24    link#1             U        vtnet0
192.168.22.100     link#1             UHS         lo0

Does anyone have any ideas?

I am grateful for any inspiration.

I have no access to the other side.
IP addresses have been changed by me and are only an example.

[atom]

Phase 1 entries are correct.
Phase 2 don´t match with the other side.

[herrnic]

but in the status overview the status is "installed routed".
If phase 2 did not match, this would not be possible.

[atom]

Have you marked "install policy" in phase 1 "advanced options" ?

[herrnic]

Install policy is marked

[atom]

You're default router is 192.168.10.2 and not WAN (192.168.10.198), correct ?
Do you have a network plan ?

[herrnic]

192.168.10.2 is default WAN Gateway

I do not have a network plan with me at the moment.