pfSense - IPSec through IPSec tunnel possible The Next CEO of Stack OverflowPFSense VPN Routingpfsense 2.0.2 racoon(ipsec vpn) unreliableMultiple IPsec tunnels implented with raccon - need tunnel specific debug outputpfSense - Site to Site OpenVPNVpn tunnel to Amazon VPC with pfsenseRouting through IPSec tunnelpfSense to Amazon VPC IPsec VPN Tunnel Fails to ConnectPrivate networks routing over IPSEC VPNUniFi and pfSense IPSec VPN not passing trafficMultiple IpSec VPNs in failover config - pfSense to Draytek
Multi tool use
Is there a way to save my career from absolute disaster?
Why do airplanes bank sharply to the right after air-to-air refueling?
What was the first Unix version to run on a microcomputer?
Why don't programming languages automatically manage the synchronous/asynchronous problem?
Bold, vivid family
How did people program for Consoles with multiple CPUs?
MessageLevel in QGIS3
Why do remote companies require working in the US?
Would this house-rule that treats advantage as a +1 to the roll instead (and disadvantage as -1) and allows them to stack be balanced?
What is the result of assigning to std::vector<T>::begin()?
Is it professional to write unrelated content in an almost-empty email?
Novel about a guy who is possessed by the divine essence and the world ends?
Why am I allowed to create multiple unique pointers from a single object?
Why has the US not been more assertive in confronting Russia in recent years?
Calculus II Question
sp_blitzCache results Memory grants
Rotate a column
Return the Closest Prime Number
How to count occurrences of text in a file?
Is it my responsibility to learn a new technology in my own time my employer wants to implement?
Help understanding this unsettling image of Titan, Epimetheus, and Saturn's rings?
How to safely derail a train during transit?
In excess I'm lethal
Interfacing a button to MCU (and PC) with 50m long cable
pfSense - IPSec through IPSec tunnel possible
The Next CEO of Stack OverflowPFSense VPN Routingpfsense 2.0.2 racoon(ipsec vpn) unreliableMultiple IPsec tunnels implented with raccon - need tunnel specific debug outputpfSense - Site to Site OpenVPNVpn tunnel to Amazon VPC with pfsenseRouting through IPSec tunnelpfSense to Amazon VPC IPsec VPN Tunnel Fails to ConnectPrivate networks routing over IPSEC VPNUniFi and pfSense IPSec VPN not passing trafficMultiple IpSec VPNs in failover config - pfSense to Draytek
I have three sites connected with two IPSec tunnels:
Site A - 192.168.10.0/24
|
IPSec tunnel
|
Site B - 192.168.0.0/24
|
IPSec tunnel
|
Site C - 10.0.0.0/8
This works great, and I can reach Site A and Site C from Site B. What I need is to reach Site C from Site A. Is that possible with my current setup?
vpn ipsec pfsense
asked yesterday
pgbpgb
2851417
add a comment |
I have three sites connected with two IPSec tunnels:
Site A - 192.168.10.0/24
|
IPSec tunnel
|
Site B - 192.168.0.0/24
|
IPSec tunnel
|
Site C - 10.0.0.0/8
This works great, and I can reach Site A and Site C from Site B. What I need is to reach Site C from Site A. Is that possible with my current setup?
vpn ipsec pfsense
asked yesterday
pgbpgb
2851417
add a comment |
I have three sites connected with two IPSec tunnels:
Site A - 192.168.10.0/24
|
IPSec tunnel
|
Site B - 192.168.0.0/24
|
IPSec tunnel
|
Site C - 10.0.0.0/8
This works great, and I can reach Site A and Site C from Site B. What I need is to reach Site C from Site A. Is that possible with my current setup?
vpn ipsec pfsense
asked yesterday
pgbpgb
2851417
I have three sites connected with two IPSec tunnels:
Site A - 192.168.10.0/24
|
IPSec tunnel
|
Site B - 192.168.0.0/24
|
IPSec tunnel
|
Site C - 10.0.0.0/8
This works great, and I can reach Site A and Site C from Site B. What I need is to reach Site C from Site A. Is that possible with my current setup?
vpn ipsec pfsense
vpn ipsec pfsense
asked yesterday
pgbpgb
2851417
asked yesterday
pgbpgb
2851417
asked yesterday
pgbpgb
2851417
asked yesterday
pgbpgb
2851417
asked yesterday
pgbpgb
2851417
2851417
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Assuming that you don't want to negotiate an additional tunnel between Site A and Site C directly, you can do this simply by negotiating the appropriate IPsec policies on the two existing connections (and, of course, allowing forwarding of that traffic on Site B).
Between Site A and B you negotiate 10.0.0.0/8 on Site B and between Site B and Site C you negotiate 192.168.10.0/24 on Site B. This enables Site A and Site C to send traffic to those additional subnets to Site B, which then also can forward that traffic appropriately (it needs forward policies that allow traffic from 192.168.10.0/24 to 10.0.0.0/8 and vice-versa).
If you use IKEv2 you can simply add the additional subnets to Site B's local traffic selector for each of the two connections. And similarly on Site A and Site C for their remote traffic selectors, or you may configure 0.0.0.0/0 there to let Site B do the narrowing to the two subnets.
answered 20 hours ago
ecdsaecdsa
2,032915
Sorry for the silly follow up... By "negotiate10.0.0.8", you mean adding another Phase 2?
– pgb
13 hours ago
No, adding another subnet to the traffic selector of the existing Phase 2/CHILD_SA. (Although, you can obviously add another CHILD_SA, but it's not really necessary.)
– ecdsa
12 hours ago
Thank you! Solved it!
– pgb
11 hours ago
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f960514%2fpfsense-ipsec-through-ipsec-tunnel-possible%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Assuming that you don't want to negotiate an additional tunnel between Site A and Site C directly, you can do this simply by negotiating the appropriate IPsec policies on the two existing connections (and, of course, allowing forwarding of that traffic on Site B).
Between Site A and B you negotiate 10.0.0.0/8 on Site B and between Site B and Site C you negotiate 192.168.10.0/24 on Site B. This enables Site A and Site C to send traffic to those additional subnets to Site B, which then also can forward that traffic appropriately (it needs forward policies that allow traffic from 192.168.10.0/24 to 10.0.0.0/8 and vice-versa).
If you use IKEv2 you can simply add the additional subnets to Site B's local traffic selector for each of the two connections. And similarly on Site A and Site C for their remote traffic selectors, or you may configure 0.0.0.0/0 there to let Site B do the narrowing to the two subnets.
answered 20 hours ago
ecdsaecdsa
2,032915
Sorry for the silly follow up... By "negotiate10.0.0.8", you mean adding another Phase 2?
– pgb
13 hours ago
No, adding another subnet to the traffic selector of the existing Phase 2/CHILD_SA. (Although, you can obviously add another CHILD_SA, but it's not really necessary.)
– ecdsa
12 hours ago
Thank you! Solved it!
– pgb
11 hours ago
add a comment |
Assuming that you don't want to negotiate an additional tunnel between Site A and Site C directly, you can do this simply by negotiating the appropriate IPsec policies on the two existing connections (and, of course, allowing forwarding of that traffic on Site B).
Between Site A and B you negotiate 10.0.0.0/8 on Site B and between Site B and Site C you negotiate 192.168.10.0/24 on Site B. This enables Site A and Site C to send traffic to those additional subnets to Site B, which then also can forward that traffic appropriately (it needs forward policies that allow traffic from 192.168.10.0/24 to 10.0.0.0/8 and vice-versa).
If you use IKEv2 you can simply add the additional subnets to Site B's local traffic selector for each of the two connections. And similarly on Site A and Site C for their remote traffic selectors, or you may configure 0.0.0.0/0 there to let Site B do the narrowing to the two subnets.
answered 20 hours ago
ecdsaecdsa
2,032915
Sorry for the silly follow up... By "negotiate10.0.0.8", you mean adding another Phase 2?
– pgb
13 hours ago
No, adding another subnet to the traffic selector of the existing Phase 2/CHILD_SA. (Although, you can obviously add another CHILD_SA, but it's not really necessary.)
– ecdsa
12 hours ago
Thank you! Solved it!
– pgb
11 hours ago
add a comment |
Assuming that you don't want to negotiate an additional tunnel between Site A and Site C directly, you can do this simply by negotiating the appropriate IPsec policies on the two existing connections (and, of course, allowing forwarding of that traffic on Site B).
Between Site A and B you negotiate 10.0.0.0/8 on Site B and between Site B and Site C you negotiate 192.168.10.0/24 on Site B. This enables Site A and Site C to send traffic to those additional subnets to Site B, which then also can forward that traffic appropriately (it needs forward policies that allow traffic from 192.168.10.0/24 to 10.0.0.0/8 and vice-versa).
If you use IKEv2 you can simply add the additional subnets to Site B's local traffic selector for each of the two connections. And similarly on Site A and Site C for their remote traffic selectors, or you may configure 0.0.0.0/0 there to let Site B do the narrowing to the two subnets.
answered 20 hours ago
ecdsaecdsa
2,032915
Assuming that you don't want to negotiate an additional tunnel between Site A and Site C directly, you can do this simply by negotiating the appropriate IPsec policies on the two existing connections (and, of course, allowing forwarding of that traffic on Site B).
Between Site A and B you negotiate 10.0.0.0/8 on Site B and between Site B and Site C you negotiate 192.168.10.0/24 on Site B. This enables Site A and Site C to send traffic to those additional subnets to Site B, which then also can forward that traffic appropriately (it needs forward policies that allow traffic from 192.168.10.0/24 to 10.0.0.0/8 and vice-versa).
If you use IKEv2 you can simply add the additional subnets to Site B's local traffic selector for each of the two connections. And similarly on Site A and Site C for their remote traffic selectors, or you may configure 0.0.0.0/0 there to let Site B do the narrowing to the two subnets.
answered 20 hours ago
ecdsaecdsa
2,032915
answered 20 hours ago
ecdsaecdsa
2,032915
answered 20 hours ago
ecdsaecdsa
2,032915
answered 20 hours ago
ecdsaecdsa
2,032915
2,032915
Sorry for the silly follow up... By "negotiate10.0.0.8", you mean adding another Phase 2?
– pgb
13 hours ago
No, adding another subnet to the traffic selector of the existing Phase 2/CHILD_SA. (Although, you can obviously add another CHILD_SA, but it's not really necessary.)
– ecdsa
12 hours ago
Thank you! Solved it!
– pgb
11 hours ago
add a comment |
Sorry for the silly follow up... By "negotiate10.0.0.8", you mean adding another Phase 2?
– pgb
13 hours ago
No, adding another subnet to the traffic selector of the existing Phase 2/CHILD_SA. (Although, you can obviously add another CHILD_SA, but it's not really necessary.)
– ecdsa
12 hours ago
Thank you! Solved it!
– pgb
11 hours ago
Sorry for the silly follow up... By "negotiate
10.0.0.8", you mean adding another Phase 2?– pgb
13 hours ago
Sorry for the silly follow up... By "negotiate
10.0.0.8", you mean adding another Phase 2?– pgb
13 hours ago
No, adding another subnet to the traffic selector of the existing Phase 2/CHILD_SA. (Although, you can obviously add another CHILD_SA, but it's not really necessary.)
– ecdsa
12 hours ago
No, adding another subnet to the traffic selector of the existing Phase 2/CHILD_SA. (Although, you can obviously add another CHILD_SA, but it's not really necessary.)
– ecdsa
12 hours ago
Thank you! Solved it!
– pgb
11 hours ago
Thank you! Solved it!
– pgb
11 hours ago
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f960514%2fpfsense-ipsec-through-ipsec-tunnel-possible%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
i,N7HSwj2VZ2ueemp y,iK1fsQjYexhZqcDTUEOTiSTxfwlLef1 yG4EyPX6 dK9SfIexmaw,XiCDoEY
