Why do I need to temporarily disable firewall to bring up peer's GRE interface?

[tbk49]

As the title says, have been troubleshooting incoherent gre behaviour over last day or two, uttering bad words in frustration etc, and have finally found a common thread: if I disable the opnsense firewall (fw | advanced | miscellaneous), the peer's gre tunnel comes up immediately. If I then re-enable the firewall, the tunnel stays up. I can't accept this in a production environment.

I have fw rules on ipsec and WAN to allow GRE protocol.

What is the problem?

https://forum.opnsense.org/index.php?topic=6131.0 --- related?

[nero355]

I have read a long time ago (Think towards 15 to 20 years!) that GRE needs Port 0 forwarded in order to work properly and some Routers could not handle that at the time.

Maybe you are dealing with something similar ?!

[tbk49]

I can't tell whether you are having a joke here or not, but if not, you're telling me opnsense and neither freebsd have solved a 20 year old problem?...

[Patrick M. Hausen]

GRE does not have ports. It's its own protocol on top of IP independent of TCP and UDP. Port 0 might be a historical frontend abstraction of some product for not having port numbers at all.

[lmoore]

I have fw rules on ipsec and WAN to allow GRE protocol.

I don't understand why you would be running GRE over an IPSEC tunnel, is this what you are doing?

Reading through one of the articles, during troubleshooting they mention not setting keep state for the GRE rule.

Have you tried a rule like this for GRE where you have Direction set to Both and set state to no state - advanced option under Stateful firewall?

Code Select Expand

@625 pass quick on re0 inet proto gre all no state label "c18f1b78-d4dc-46fb-9bb5-61c3ae3d8693"

[Patrick M. Hausen]

I don't understand why you would be running GRE over an IPSEC tunnel

At times when VTIs did not yet exist but you wanted a dedicated interface for your IPsec VPN, e.g. to run OSPF on it or similar, a common setup was to establish an IPIP or GRE tunnel and encrypt these packets in transport mode.

[lmoore]

I don't understand why you would be running GRE over an IPSEC tunnel

At times when VTIs did not yet exist but you wanted a dedicated interface for your IPsec VPN, e.g. to run OSPF on it or similar, a common setup was to establish an IPIP or GRE tunnel and encrypt these packets in transport mode.

Thanks Patrick. That makes sense.

[nero355]

I can't tell whether you are having a joke here or not, but if not, you're telling me opnsense and neither freebsd have solved a 20 year old problem?...

I am telling you what I happen to know : That's all :)

GRE does not have ports. It's its own protocol on top of IP independent of TCP and UDP. Port 0 might be a historical frontend abstraction of some product for not having port numbers at all.

Could be... I can't remember anymore... Too long ago...

Also no further experience with GRE or IPSec :)