I run GRE tunnel over an IPSec connection to opnsense fw. I use two MT devices. One MT device is consistently fine, the other not so much.
Unless requested, I will omit the ipsec config from below, because I'm sure it works as I can see installed SAs and can ping the ipsec IP on the fw. The issue is the GRE tunnel that runs over it. It just wont come up for some reason.
/interface/gre/export terse
/interface gre add allow-fast-path=no local-address=10.48.48.2 name=test-gre remote-address=10.48.48.1
/interface/bridge/export terse
/interface bridge add fast-forward=no name=test-vpn-lo port-cost-mode=short protocol-mode=none
ip/address/export terse
/ip address add address=172.16.4.2/30 interface=test-gre network=172.16.4.0
/ip address add address=10.48.48.2/29 interface=test-vpn-lo network=10.48.48.0
The opnsense firewall lo1 IP is 10.48.48.1/29. Pinging 10.48.48.1 from src-address 10.48.48.2 works.
I have firewall rules on MT to allow GRE protocol in/out and can see log output showing:
output: in:(unknown 0) out:ether1, connection-state:established proto 47, 10.48.48.2->10.48.48.1, len 48
However, if I sniff the traffic on the other side's GRE tunnel I cannot see incoming GRE packets. I can see the opnsense trying to send GRE packets though. Likewise if I use torch on test-gre from MT, I don't see any incoming/outgoing GRE packets. So either the MT isn't sending them, or the opnsense fw isn't receiving them, or something is blocking traffic somwhere, right?
Btw I have used the same config on the other MT. The config doesn't drift much, only changing for IPs, e.g. with IP 10.48.48.3 (and 10.48.48.1 again for opnsense fw) and tunnel network 172.16.9.0/30. Both the IPSec and GRE tunnel come up immediately after IPSec established. So I'm not sure what is wrong with this specific GRE tunnel on this MT. Also, between the two MT devices, the firewall rules are equal.
Any thoughts?
EDIT: no, both GRE tunnels are not working.
Disabling the opnsense firewall, both GRE interfaces came up. So problem not MT.