Can't communicate on remote ip using local vip through IPSEC (IPSEC is up + Test port works)

Raul Chiarella

10/31/23, 5:31 PM

good afternoon. I have the following problem in pfSense:

The Service for package Zabbix Proxy not want to go up.

The scenario is as follows:

pfSense has a IPSEC VPN with Zabbix Server

Zabbix IP is 192.168.1.248
pfSense has a VIP (Virtual IP) linked to pfSense, which is what Zabbix Server will use to communicate on Phase 2 of IPSEC

Virtual IP is 172.16.250.10
If i go to Diagnostics > Test Port and select interface VIP 172.16.250.10 and try to connect on 192.168.1.248:10052 (Which is the port Zabbix Server is listening) i get a SUCCESS message, but if i don't specify a interface, i get a connection error message

When i try to start Zabbix Proxy service, it reports that the Zabbix Server IP is unavailable (Unable to connect to 192.168.1.248:10052...) So, i believe that the route that Zabbix Proxy is trying to do is NOT through the VIP.

So that's why it's not getting a success message when connecting to the Proxy. I believe that the Zabbix Proxy service in pfSense is getting a different interface than the VIP one...

I am almost sure that i must have to do some Outbound NAT. I even managed to do one according to the image below, but it's not working.

My logic when creating this NAT below (I don't know if I made the rule correctly): Every connection attempt on IP 192.168.1.248 on port 10052, use the VIP interface.

Please, how can i explicity and globally say to pfSense that "All tries on 192.168.1.248:10052 outbound route uses interface VIP address 172.16.250.10" ?

Or if this is not the solution, what can i do ?

113

1 + 1

firewall

ipsec

pfsense

zabbix

Raul Chiarella

1/10/24, 5:16 PM

I just googled this problem and went straight to my own question.

Score:0

Server

Raul Chiarella

6/30/24, 7:53 PM

I was able to solve this by setting a route in System > Routing on pfSense for specific IPs destinations.

This for outbound routes, the other way around I had to create VIPs and use NAT.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Can't communicate on remote ip using local vip through IPSEC (IPSEC is up + Test port works)

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.