FreeBSD IPSec VPN routing problem

JoeJR joejr at
Tue Feb 13 19:03:33 UTC 2007

Hello list!

I've been playing around with IPSEC site-to-site VPN. The setup is as follows:

[Home cisco 871w, A] -> (internet) -> [FreeBSD IPsec VPN-server] -> (internet) -> [Buddy's Home cisco  871w, B].

A and B can both reach the FreeBSD IPSec server, on their VPN IPs:

A( to IPsec endpoint:
Pinging with 32 bytes of data:

Reply from bytes=32 time=84ms TTL=63
Reply from bytes=32 time=85ms TTL=63

B( to IPsec endpoint:
PING ( 56 data bytes
64 bytes from icmp_seq=0 ttl=63 time=74.705 ms
64 bytes from icmp_seq=1 ttl=63 time=74.547 ms

This is what i use to setup the GIF interfaces:
ifconfig gif0 create
ifconfig gif0 tunnel A.B.C.D E.F.G.H
ifconfig gif0 inet netmask 0xffffffff
route add

ifconfig gif1 create
ifconfig gif1 tunnel A.B.C.D I.J.K.L
ifconfig gif1 inet netmask 0xffffffff
route add

And here is my IPsec policy setup:

#/usr/sbin/setkey -F

/usr/sbin/setkey -c << EOF

spdadd any -P out ipsec esp/tunnel/A.B.C.D-I.J.K.L/unique;
spdadd any -P in ipsec esp/tunnel/I.J.K.L-A.B.C.D/unique;

spdadd any -P out ipsec esp/tunnel/A.B.C.D-E.F.G.H/unique;
spdadd any -P in ipsec esp/tunnel/E.F.G.H-A.B.C.D/unique;

Everything seems nice and dandy, however:

Pinging from with 32 bytes of data:
Request timed out.
Request timed out.

It appears the server is not routing it between the interfaces.
I have net.inet.ip.forwarding: 1 with sysctl.

Can anyone shed some light on what I am missing here to have packets from hit directly? 
Both IPs are reachable and reply on ping from the VPN server.

Click for second home mortgage, fast & free, no fees, approval today:

More information about the freebsd-questions mailing list