Home
Help
Search
Login
Register
OPNsense Forum
»
English Forums
»
General Discussion
»
VPN IPSEC site to site with virutal networks
« previous
next »
Print
Pages: [
1
]
Author
Topic: VPN IPSEC site to site with virutal networks (Read 1165 times)
Tech34
Newbie
Posts: 12
Karma: 0
VPN IPSEC site to site with virutal networks
«
on:
June 28, 2024, 04:02:44 pm »
Hello Forum,
I hope you're doing well.
I need some information about configuring an IPsec VPN on an OPNsense firewall.
I created an IPsec tunnel with a Stormshield firewall using virtual networks, but I'm unable to test the VPN tunnel. I don't know how to create virtual IP addresses and attach them to a physical interface using NAT in OPNsense. There are three types of NAT in OPNsense, and I'm unsure which one to use: NAT 1:1, outbound NAT, or port forward NAT.
I need your help to understand what I'm doing wrong. On the Stormshield firewall, I created a virtual network, which is preceded by a physical network. On the OPNsense firewall, I didn't create a virtual network, but I added it in the IPsec Phase 2 configuration.
Can you guys give me an idea of the NAT and filtering configurations that i should add in the opnsense.
Here's what the VPN tunnel looks like:
| 192.168.2.0/24 | -------------- (Stormshield [virt: 10.100.100.0/24]) ====ipsec==== (Opnsense[virt: 10.200.200.0/24]) -------------- | 192.168.100.0/24 |
This is what i'm trying to test:
Ping from 192.168.100.0/24 to 10.100.100.0/24 , i have created an object in stormshield network , that is NATTED to a physical ip address 192.168.2.201/24, but i don't know how to do the same thing in opnsense for a physical machine !
Thank you for your time guys !
«
Last Edit: June 28, 2024, 04:20:12 pm by Tech34
»
Logged
Tech34
Newbie
Posts: 12
Karma: 0
Re: VPN IPSEC site to site with virutal networks
«
Reply #1 on:
July 02, 2024, 03:49:15 pm »
Can anyone who knows how take time to answer?
i would really appreciate it !
Logged
Monviech
Global Moderator
Hero Member
Posts: 1518
Karma: 172
Re: VPN IPSEC site to site with virutal networks
«
Reply #2 on:
July 02, 2024, 04:03:39 pm »
Why do you need to NAT?
You have two networks:
192.168.2.0/24
192.168.100.0/24
There is no overlap between those networks.
Just create a policy based tunnel that connects these networks directly in Phase2.
Logged
Hardware:
DEC740
Tech34
Newbie
Posts: 12
Karma: 0
Re: VPN IPSEC site to site with virutal networks
«
Reply #3 on:
July 11, 2024, 03:23:49 pm »
Hello , thank you for your answer,
I need to NAT because the two networks are behind a virutal Network :
| 192.168.2.0/24 | -------------- (Stormshield [virt: 10.100.100.0/24]) ====ipsec==== (Opnsense[virt: 10.200.200.0/24]) -------------- | 192.168.100.0/24 |
in my case my LAN 192.168.100.0/24 has to be behind the network 10.200.200.0/24 ,
First i wanna know if it's possible to do it in opnsense because i tried to do it with Stormshield and it worked perfectly , and if it's possible how could we do it ( create the virtual network and apply the nat rules to translate from the virtual network to the local network )
Logged
Tech34
Newbie
Posts: 12
Karma: 0
Re: VPN IPSEC site to site with virutal networks
«
Reply #4 on:
July 11, 2024, 03:25:23 pm »
Also , because we got alot of VPN tunnels in our stormshield firewall , we have to create virtual networks in order to avoid ip adress conflict
Logged
Monviech
Global Moderator
Hero Member
Posts: 1518
Karma: 172
Re: VPN IPSEC site to site with virutal networks
«
Reply #5 on:
July 11, 2024, 04:30:24 pm »
Do you mean this?
https://docs.opnsense.org/manual/how-tos/ipsec-s2s-conn-binat.html
Logged
Hardware:
DEC740
Tech34
Newbie
Posts: 12
Karma: 0
Re: VPN IPSEC site to site with virutal networks
«
Reply #6 on:
July 11, 2024, 04:44:55 pm »
Hello,
thanks for the document , it worked !
Logged
Tech34
Newbie
Posts: 12
Karma: 0
Re: VPN IPSEC site to site with virutal networks
«
Reply #7 on:
July 12, 2024, 10:45:52 am »
Hello again ,
It worked from the stormshield to the OPNsense :
<a href="
https://ibb.co/qMDt3JL
"><img src="
https://i.ibb.co/SX6h4fD/Capture.png
" alt="Capture" border="0" /></a>
but not from the OPNsense to stormshield !
Logged
Tech34
Newbie
Posts: 12
Karma: 0
Re: VPN IPSEC site to site with virutal networks
«
Reply #8 on:
July 12, 2024, 02:21:56 pm »
Quick update , the ICMP works, but when i try RDP , it doesn't work , i have a question , does the BINAT do PAT ?
Logged
Monviech
Global Moderator
Hero Member
Posts: 1518
Karma: 172
Re: VPN IPSEC site to site with virutal networks
«
Reply #9 on:
July 12, 2024, 02:26:05 pm »
MTU - MSS problem?
Ipsec uses PMTUD to discover the maximum trasmission size, that requires some more ICMP options to be allowed, not only echo request and reply.
Otherwise set a hard MSS size with a Firewall - Normalization rule in OPNsense.
Here its explained for wireguard but it applies to any vpn technology when PMTUD doesnt work.
https://docs.opnsense.org/manual/how-tos/wireguard-s2s.html
Logged
Hardware:
DEC740
Tech34
Newbie
Posts: 12
Karma: 0
Re: VPN IPSEC site to site with virutal networks
«
Reply #10 on:
July 15, 2024, 09:11:56 am »
when i sniffed packets using wireshark , this is what i see :
Logged
Monviech
Global Moderator
Hero Member
Posts: 1518
Karma: 172
Re: VPN IPSEC site to site with virutal networks
«
Reply #11 on:
July 15, 2024, 11:31:35 am »
That looks like there is a SYN but no SYN-ACK. I don't know what the issue is though, it's a bit out of my reach right now.
Logged
Hardware:
DEC740
Tech34
Newbie
Posts: 12
Karma: 0
Re: VPN IPSEC site to site with virutal networks
«
Reply #12 on:
July 15, 2024, 02:13:01 pm »
it's okay, thank you for your help , you really helped me alot , in the opnsense , it keeps blocking the RDP traffic :
Logged
Tech34
Newbie
Posts: 12
Karma: 0
[Solved] VPN IPSEC site to site with virutal networks
«
Reply #13 on:
July 23, 2024, 12:26:07 pm »
Hello, i solved my issue by reading this guy's post :
https://www.reddit.com/r/OPNsenseFirewall/comments/hrdzti/nat_not_working_with_ipsec_vpn/
Logged
Print
Pages: [
1
]
« previous
next »
OPNsense Forum
»
English Forums
»
General Discussion
»
VPN IPSEC site to site with virutal networks