IPsec VPN works only one way - GCP

[rbed]

Tunnel details for the Azure guide setup

[rbed]

LAN is the only interface (I deleted the weird OPT1)

[mimugmail]

Why only the LAN? Shouldn't it be WAN? Is this the GCP box or on-prem?
And why respond only? Also /128 looks weird

[rbed]

The OPNsense VPN Gateway (.99) is not the default gateway (that's .65).

There Azure guide https://docs.opnsense.org/manual/how-tos/ipsec-s2s-route-azure.html had "respond only" in it, that's why.

I was wondering about the /128, too, but I cannot change it.

[rbed]

Some more intel:

I see the traffic DC -> GCP coming through in the FW logs on .99. I can also see it in the FW logs within the GCP in the allow-ingress rule I've set up.
I can then also see traffic going back within the GCP but apparently it's lost after that.

[mimugmail]

I need a Network diagram including IP addresses to fully understand this setup

[rbed]

Here's one. I hope that helps.
Actually I'm not 100% sure whether or not .99's traffic is passing through .66 or not.

[mimugmail]

When .65 gateway of .66 is, why .99? I dont get it

[rbed]

That's the not so well documented setup I inherited. The .99 is there because we didn't want to mess around with our live FW.

[mimugmail]

Please use real IPs and changing only one bit, really, noone is interested in your network :) someone around the globe is always scanning it

[rbed]

Apparently the wrong route was chosen on the way back from the tunnel and then the response was eaten by the bridging firewall.