Why do I need to temporarily disable firewall to bring up peer's GRE interface?

[Monviech (Cedrik)]

Heres the example setup from the documentation:

https://docs.opnsense.org/manual/how-tos/dynamic_routing_ospf.html#ipsec-failover-with-policy-based-tunnels-gre-and-ospf

I wrote that, but Im not an expert on GRE, but I didnt have issues with it not establishing with the firewall enabled.

Maybe what you have is a new issue, or something that wasnt noticed yet.

Though I know others who e.g., get Hurricane Electric IPv6 nets over GRE and there arent too many reports that something is wrong with that either.

So the simplest assumption is that the firewall rules are wrong somehow.

[lmoore]

Since I'm running GRE over IPSec, do I need a GRE rule on WAN

No - I hadn't fully visualised your set-up when I posted that rule.

In review, you don't mention having OPNsense logging of Default block being enabled. This is where I would expect PF to log the blocked packets arriving from the peer at the other end.

As you don't have an interface for IPsec, testing with a rule which is applied to all interfaces other than your WAN may help;

e.g. setting Invert interface in the rule I provided earlier. You may want to enable logging initially to verify the rule is being used.

Code Select Expand

@329 pass log quick on ! re0 inet proto gre all no state label "9dc1eb15-4dd3-44b1-adbc-04385d9f9955"

[Patrick M. Hausen]

L2TP over IPsec is of course still widely used. And as I stated: the modern alternative - in case you need a dedicated interface for e.g. a routing protocol - is to use a virtual tunnel interface instead of a policy based VPN. OPNsense can do that perfectly well.

I guess your firewall rules are not sufficient for the GRE over IPsec to be permitted. But that is simply too much complexity for my tastes when IPsec with a dedicated interface exists and is well supported.

https://docs.opnsense.org/manual/vpnet.html#route-based-vti