opnsense / core

OPNsense GUI, API and systems backend
https://opnsense.org/
BSD 2-Clause "Simplified" License
3.35k stars 749 forks source link

IPSec traffic leaves on wrong interface (default GW) in multi-WAN setup #6013

Closed Ketanest closed 1 year ago

Ketanest commented 2 years ago

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

Describe the bug

IPSec traffic leaves the firewall on the interface where the default gateway lies and not on the configured interface. It doesn't matter if a CARP IP or the interface is used.

Tip: to validate your setup was working with the previous version, use opnsense-revert (https://docs.opnsense.org/manual/opnsense_tools.html#opnsense-revert)

To Reproduce

Steps to reproduce the behavior:

  1. Configure more than 1 WAN interface.
  2. Configure Gateways on these interfaces with priorities.
  3. Configure IPSec-Tunnel on lower priorized interface (higher value)
  4. Packet Capture both WAN interfaces
  5. See traffic on wrong interface (interface where default gateway is) going out.

Expected behavior

Traffic is routed out on the correct interface via the belonging gateway.

Describe alternatives you considered

Manually set route to IPSec endpoint via the correct gateway solves that problem.

Additional infos pfSense bug https://redmine.pfsense.org/issues/4174 seems related.

Environment

Software version used and hardware type if relevant, e.g.:

OPNsense 22.4.3_1 (amd64, OpenSSL).

OPNsense-bot commented 1 year ago

This issue has been automatically timed-out (after 180 days of inactivity).

For more information about the policies for this repository, please read https://github.com/opnsense/core/blob/master/CONTRIBUTING.md for further details.

If someone wants to step up and work on this issue, just let us know, so we can reopen the issue and assign an owner to it.