Project

General

Profile

Actions

Feature #7410

closed

IPSEC multiple dynamic IP remote clients

Added by Sebastien WILD about 7 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Very Low
Assignee:
-
Category:
IPsec
Target version:
-
Start date:
03/20/2017
Due date:
03/24/2017
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:

Description

We are actually running version 2.3.2 using mainly pfsense as a IPSEC VPN server for multiple remote locations.
Remote locations have only dynamic IP.
In order to identify remote IPSEC clients, we have to specify (VPN/IPSEC/TUNNELS/GENERAL INFO) the Remote Gateway (IP or host name).
Until now, we were using DDNS service, but remote clients are complaining because some time it takes lot of time to update (mainly when pfsense update info from ddns server after a reboot of wan access on remote site).
So we tried to specify in Remote Gateway 0.0.0.0 which gives a great result… but only for 1 tunnel ! FYI, we don’t need to authenticate IPSEC client with there IP.
And from what we saw, if we have sevral tunnels, 0.0.0.0 can be specified for only one of them, otherwise it gives an error saying this IP is already used.
We bypassed this error message by using different hostnames pointing to 0.0.0.0, but even if we don't have this error message anymore, only one tunnel is establishing well, others are failing in phase 1.
So my question is could you please provide solution for allowing more than 1 tunnel using 0.0.0.0 as Remote Gateway, enabling pfsense to handle sevral (dynamic remote ip) tunnels using 0.0.0.0 as remote Gateway, and by doing this accepting requests from ANY remote IP.
From what i found, this issue as already been mentioned sevral times on forums, like this post: https://forum.pfsense.org/index.php?topic=98956.0

Actions #1

Updated by Jim Pingle about 7 years ago

  • Tracker changed from Bug to Feature
  • Assignee deleted (Anonymous)
  • Priority changed from Urgent to Very Low
  • Target version changed from 2.3.4 to Future

If it's possible, it will take some time/thought about how best to handle.

Actions #2

Updated by Viktor Gurov over 3 years ago

  • Status changed from New to Closed

Implemented in #7095 and #10214

Actions #3

Updated by Jim Pingle over 3 years ago

  • Target version deleted (Future)
Actions

Also available in: Atom PDF