Project

General

Profile

Actions
Copy link

Bug #16764

open

IPSec VTI assigned interfaces generating an incorrect table for /32 addresses

Added by Georgiy Tyutyunnik 4 months ago. Updated 17 days ago.

Status:
Confirmed
Priority:
Normal
Assignee:
-
Category:
Aliases / Tables
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

If I create an IPSEC VTI tunnel and assign it as interface using strictly /32 interfaces as p2p in phase2, the resulting interface network table in pf would be /30.

Files

Download all files
clipboard-202604031440-2ev9t.png (19.9 KB) clipboard-202604031440-2ev9t.png aleksei prokofiev, 04/03/2026 11:40 AM
clipboard-202604031440-zz9wz.png (10.8 KB) clipboard-202604031440-zz9wz.png aleksei prokofiev, 04/03/2026 11:40 AM
clipboard-202604111812-t5wrm.png (54.3 KB) clipboard-202604111812-t5wrm.png Lev Prokofev, 04/11/2026 03:12 PM
clipboard-202604111813-hcmin.png (56.1 KB) clipboard-202604111813-hcmin.png Lev Prokofev, 04/11/2026 03:13 PM
clipboard-202604111813-sf1dr.png (43 KB) clipboard-202604111813-sf1dr.png Lev Prokofev, 04/11/2026 03:13 PM
status_output_vti.tgz (309 KB) status_output_vti.tgz Georgiy Tyutyunnik, 06/24/2026 11:58 AM
clipboard-202606271234-fhyhc.png (54 KB) clipboard-202606271234-fhyhc.png Lev Prokofev, 06/27/2026 09:34 AM
clipboard-202606271235-vbazn.png (55.8 KB) clipboard-202606271235-vbazn.png Lev Prokofev, 06/27/2026 09:35 AM
Actions
Copy link
 #1

Updated by aleksei prokofiev 3 months ago

Tested on 26.03-RELEASE (amd64)
built on Wed Apr 1 20:20:00 MSK 2026
FreeBSD 16.0-CURRENT
Can not reproduce

Actions
Copy link
 #3

Updated by Kris Phillips 3 months ago

  • Status changed from New to Incomplete
Actions
Copy link
 #4

Updated by Georgiy Tyutyunnik 20 days ago

I still can consistently reproduce it, with the exact phase2 config from the attached s_o
you need to have local and remote traffic selector type set to "address" type, and assign the resulting tunnel as the interface

Actions
Copy link
 #5

Updated by Lev Prokofev 20 days ago

  • Status changed from Ready To Test to Confirmed
Actions
Copy link
 #6

Updated by Lev Prokofev 17 days ago

Can confirm that it is reproducible on

26.07-BETA (amd64)
built on Fri Jun 26 1:40:00 UTC 2026
FreeBSD 16.0-CURRENT

P2 set as address, rules generated with /30


block drop in log on ! ipsec1 inet from 172.10.0.4/30 to any label "descr=antispoof protection" ridentifier 1000003581
pass out inet from 172.10.0.4 to ! 172.10.0.4/30 flags S/SA keep state (if-bound) allow-opts label "descr=let out anything from firewall host itself" ridentifier 1000005822

vpn_networks table shows /32

OPT5_NETWORK shows /30

Actions
Copy link

Also available in: Atom PDF