Project

General

Profile

Actions

Bug #3654

closed

Outbound IPsec rules do not exclude WAN subnet

Added by Jim Pingle almost 10 years ago. Updated over 9 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
IPsec
Target version:
Start date:
05/12/2014
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.2
Affected Architecture:
All

Description

Either the rules need adjusted or we're missing the patch that automatically excludes WAN subnet traffic from route-to.

Default rules for IPsec outbound look like so:

pass out log on $WAN  route-to ( em0 192.168.2.1 )  proto udp from any to 192.168.2.5 port = 500 tracker 1000104251 keep state label "IPsec: My Tunnel - outbound isakmp" 

The packets are delivered to the gateway instead of directly to the target system, which will often break.

The firewall rules in general do have an exclusion:

pass out log route-to ( em0 192.168.2.1 ) from 192.168.2.8 to !192.168.2.0/24 tracker 1000003811 keep state allow-opts label "let out anything from firewall host itself" 

Actions #1

Updated by Ermal Luçi almost 10 years ago

  • Status changed from New to Feedback

Pushed a patch for this!
It is the same as for reply-to.

Actions #2

Updated by Chris Buechler over 9 years ago

  • Status changed from Feedback to Resolved

confirmed working (rules don't exclude, patch works)

Actions

Also available in: Atom PDF