Hi everyone,
Thanks in advance for your help.
I have a setup as described below. The issue has been resolved by exempting
"ipsec policy in ipsec in chain prerouting (image attached)
but I’m still unsure why it happened. I’d really appreciate it if someone could help clarify the reason behind it.
We have two WAN interfaces at both our regional office and head office:
WAN1 (VT)
WAN2 (TW)
Some users are policy-routed to access the internet via WAN1 (VT), while others use WAN2 (TW).
An IPSec VPN tunnel has been successfully established between WAN2 (TW) of the head office and WAN2 (TW) of the regional office.
The Issue:
Users routed through WAN1 (VT) can access internal servers at the head office over the VPN without any problems.
However, users routed through WAN2 (TW) (which is where the IPSec tunnel is actually established) cannot access internal servers at the head office.
We are using mangle rules based on source address lists to differentiate between traffic going out via VT and TW.
Interestingly, if a user from the TW group is switched to the VT address list, they are then able to access the head office internal server successfully.
There is no specific route in the routing table with a destination address matching the public IP of the head office’s WAN2, yet VT users can still reach the internal server.
The only way TW users can access the internal server is if I manually add a static route in the main routing table with:
Destination: Head office’s public TW IP
Gateway: Local TW interface
Finding:
Seems VT users Traffic is not being marked, hence using main Table.
while TW user Traffic is marked, and not finding route in to_TW table causes packet to drop.
Questions:
Why do VT users not need a static route to access the internal head office server?
Why do TW users require a manual static route, even though the IPSec VPN is established on TW?
