New answers tagged ipsec
1
Since the connection uses a virtual IP address (leftsourceip=%config, which results in 10.10.102.235/32 as local traffic selector), you have to NAT traffic to that address, not the host's physical one you get via MASQUERADE, in order to match the IPsec policies and tunnel the traffic (-I to insert it at the top):
iptables -t nat -I POSTROUTING -j SNAT --to-...
0
It turns out the solution is an additional xfrm policy. The thinking behind it is that whilst packets are getting onto the interface, the traffic isn't being "scooped up" by ipsec. To resolve the problem, it seems we need to mark the packets (in the same way as we do in the ipsec config and iptables), and also to specifically "activate" ...
0
Working swanctl config of strongswan in client mode when connecting to a L2TP VPN hub with PSK:
connections {
vpnhub {
local-1 {
id=192.168.1.27
auth=psk
}
remote-1 {
id=325.678.571.25
auth=psk
}
children {
default {
esp_proposals=aes128-...
0
It would definitely mess up the ipsec/vpn configuration set up in the pfSence itself. As about routing/firewall part - doubt it, but still possible. Anyway, the psSense is like a starter FreeBSD pack for newbies, so as soon as you're starting asking questions about the underlying OS it means you're ready for the next level.
There's nothing difficult in ...
Top 50 recent answers are included