OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • English Forums »
  • Virtual private networks »
  • [Worked-around] IKEv2 S2S IPv6 doesn't come up after reboot
« previous next »
  • Print
Pages: [1]

Author Topic: [Worked-around] IKEv2 S2S IPv6 doesn't come up after reboot  (Read 909 times)

StartersOrders

  • Newbie
  • *
  • Posts: 5
  • Karma: 0
    • View Profile
[Worked-around] IKEv2 S2S IPv6 doesn't come up after reboot
« on: February 18, 2022, 10:21:17 am »
Strange one this.

I have an OVH/SYS start VMware server with OPNsense 22.1.1_1 (so far gateway is a thing). As a result I'm having to use Hurriane Electric's IPv6 tunnel service to get IPv6 to my internal network.

This works fine, if a bit Heath Robinson with two WAN interfaces, one for v4 and one for v6.

What is very odd is that the IPsec VPN I run between home and the OPNsense box doesn't survive a reboot particularly well. The IPv4 P2s work fine after a reboot, but the IPv6 P2 (for the /48 at each end) doesn't appear to come up and instead stays down even though it's installed. Before the reboot it works fine?

To test I snapshotted (with RAM) the VM and rebooted it, which killed the ping I had running to the LAN interface. Once I restored the snapshot (soas if it had never been rebooted) the ping started working again?! Again, the whole time the IPv4 P2s were fine and I could ping each end of the VPN once they'd re-established.

Oddly this exact setup works fine on pfSense, although that has it's own issues.
« Last Edit: February 19, 2022, 06:49:59 pm by StartersOrders »
Logged

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13699
  • Karma: 1178
    • View Profile
Re: IKEv2 S2S IPv6 doesn't come up after reboot
« Reply #1 on: February 18, 2022, 10:42:19 am »
Might be same as https://forum.opnsense.org/index.php?topic=26700.0 and we're working on it... it should be fixed in the latest development version. Changes are too many to use opnsense-patch reliably.

If you can snapshot it's worth a try to change release type to development check for updates and install plus reboot.


Cheers,
Franco
Logged

StartersOrders

  • Newbie
  • *
  • Posts: 5
  • Karma: 0
    • View Profile
Re: IKEv2 S2S IPv6 doesn't come up after reboot
« Reply #2 on: February 18, 2022, 10:48:37 am »
Quote from: franco on February 18, 2022, 10:42:19 am
Might be same as https://forum.opnsense.org/index.php?topic=26700.0 and we're working on it... it should be fixed in the latest development version. Changes are too many to use opnsense-patch reliably.

If you can snapshot it's worth a try to change release type to development check for updates and install plus reboot.


Cheers,
Franco

Just tried - no dice unfortunately :(

It's a VM I can swap out at will so I don't mind doing destructive testing!
Logged

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13699
  • Karma: 1178
    • View Profile
Re: IKEv2 S2S IPv6 doesn't come up after reboot
« Reply #3 on: February 18, 2022, 01:40:31 pm »
Ok, let's back up a little then. Are we talking about GIF not coming up on boot or IPsec over IPv6 or both? I'd like to inspect system log a little. It should throw at least 1-2 configuration errors that would indicate a failure to init all during boot.


Cheers,
Franco
Logged

StartersOrders

  • Newbie
  • *
  • Posts: 5
  • Karma: 0
    • View Profile
Re: IKEv2 S2S IPv6 doesn't come up after reboot
« Reply #4 on: February 18, 2022, 01:52:41 pm »
Quote from: franco on February 18, 2022, 01:40:31 pm
Ok, let's back up a little then. Are we talking about GIF not coming up on boot or IPsec over IPv6 or both? I'd like to inspect system log a little. It should throw at least 1-2 configuration errors that would indicate a failure to init all during boot.


Cheers,
Franco

It appears to just be the IPsec side of things as I can remotely ping over the GIF tunnel, it's just the IPsec-connected networks that don't work.

How do you want the logs?
Logged

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13699
  • Karma: 1178
    • View Profile
Re: IKEv2 S2S IPv6 doesn't come up after reboot
« Reply #5 on: February 18, 2022, 02:05:02 pm »
This is VTI, right?

I think it's unable to configure the assigned interface... Can you check?

# opnsense-log | grep Unable.to.configure


Cheers,
Franco
Logged

StartersOrders

  • Newbie
  • *
  • Posts: 5
  • Karma: 0
    • View Profile
Re: IKEv2 S2S IPv6 doesn't come up after reboot
« Reply #6 on: February 18, 2022, 02:11:06 pm »
Quote from: franco on February 18, 2022, 02:05:02 pm
This is VTI, right?

I think it's unable to configure the assigned interface... Can you check?

# opnsense-log | grep Unable.to.configure


Cheers,
Franco

No, straight IPsec policies.

I ran the command and obviously nothing returned.
Logged

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13699
  • Karma: 1178
    • View Profile
Re: IKEv2 S2S IPv6 doesn't come up after reboot
« Reply #7 on: February 19, 2022, 08:57:35 am »
Not sure what's wrong to be honest. There's little data to analyse further about your setup and actual system state (routes, IPs, ping from where).


Cheers,
Franco
Logged

StartersOrders

  • Newbie
  • *
  • Posts: 5
  • Karma: 0
    • View Profile
Re: IKEv2 S2S IPv6 doesn't come up after reboot
« Reply #8 on: February 19, 2022, 06:49:14 pm »
Right, gave in and coverted the other end to OPNsense after the Other Vendor (tm) decided to go on a Reddit locking spree...

... And it works with both ends as OPNsense afer a reboot in policy mode! Very strange, but I'm a happy man  ;D
Logged

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13699
  • Karma: 1178
    • View Profile
Re: [Worked-around] IKEv2 S2S IPv6 doesn't come up after reboot
« Reply #9 on: February 19, 2022, 07:40:28 pm »
Oh, happy to hear that... welcome to the family. :)

Looks I need to read up on Reddit.


Cheers,
Franco
Logged

  • Print
Pages: [1]
« previous next »
  • OPNsense Forum »
  • English Forums »
  • Virtual private networks »
  • [Worked-around] IKEv2 S2S IPv6 doesn't come up after reboot
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2023 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2