Works out of the box

[simonryf]

Thx man, you saved me probably quite some time. 🙏

Just 2 minor things:

• FW Rule on WAN, ISAKMP and IPsec NAT-T is actually only UDP
• VPN/IPsec/Mobile Clients/Virtual IPv4 Address Pool: Cosmetic but you could give the NW-Address (so 192.168.2.0/24 instead of 192.168.2.1)

BTW: I needed a reboot as well to make things work :-)

(Tested on OPNsense 23.7.9-amd64 + IOS 17.1.1 / Somona 14.1.1)

[retrohospital]

Another comment on this near-perfect tutorial ( thanks again for making it)

On my opnsense ( OPNsense 24.7.5_3 ) and possibly others, adding a "legacy" ipsec config auto-creates WAN firewall rules ( UDP 500,4500 and ESP) which makes adding rules manually redundant. The rules are hidden inside a 6 rule "auto generated folder" at the top of the ruleset. These are UDP ports indeed, as the previous comment said.

[thomergil]

@simonryf, thank you. I am pushing a fix for these changes.

[thomergil]

@retrohospital, can you clarify which step you are referring to? When I look at my OPNsense now, I see a Tunnel Settings [legacy] under VPN -> IPsec. Is that what you used?

[retrohospital]

Yes basically following your tutorial now auto creates wan rules ; so creating some manually should not be necessary anymore . there is a setting to disable the auto rules but it is disabled by default

just fyi !