pfSense

Jim Pingle wrote:

It used to work at one time, if it doesn't work now, it's almost certainly the same root cause as #8686 so doesn't need its own issue. There are workarounds available on that issue.

Are you referring to the workaround that breaks policy based routing? What does that specifically break, any rule that uses the ipsec interface as a gateway regardless of any interfaces that rule is applied on?

It doesn't break policy routing. It breaks filtering of policy based IPsec tunnels (ones using tunnel mode, not VTI).

Jim Pingle wrote:

It doesn't break policy routing. It breaks filtering of policy based IPsec tunnels (ones using tunnel mode, not VTI).

Ahh. I see what you're saying. So does that mean that since I'm using Routed VTI and don't use traditional policy-based IPsec anyway, then applying the workaround won't really affect me negatively, yes?

Correct. Keep any further discussion on the forum, though.

Jim Pingle wrote:

Correct. Keep any further discussion on the forum, though.

Thanks. I tried to apply the workaround but it's not working for me. It breaks things even further. Let me know if you have any advices or if I'm doing it incorrectly and let's continue our conversation here: https://forum.netgate.com/post/953770 if you don't mind.

Kevin Mychal Ong wrote:

Jim Pingle wrote:

Correct. Keep any further discussion on the forum, though.

Thanks. I tried to apply the workaround but it's not working for me. It breaks things even further. Let me know if you have any advices or if I'm doing it incorrectly and let's continue our conversation here: https://forum.netgate.com/post/953770 if you don't mind.

Jim, do you have any more ideas here?