External VPN through pfSense fails

VPN
1

Howdy pfSense Redditors!

I have a small pfSense network at home. Pretty much just logically seperated my network into two LANs (LAN & OPT1). Right now during setup, everything has an “Any Any” Rule. So, my network flow is…

(LAN) LAPTOP → 24 PORT SWITCH → PFSENSE → ISP MODEM

(OPT1) LAPTOP → WIFI ROUTER → PFSENSE → ISP MODEM

My work requests that we connect to the Work VPN (Ubiquity L2TP) for all work activities. Makes sense, right? But, when I try to connect to the Work VPN (either LAN or OPT1), I keep getting this error…

“The L2TP connection attempt failed because the security layer encountered a processing error during initial negotiations with the remote computer”

Now, when I skip pfSense all together, I connect easily to my Work VPN.

When I view the packet capture in pfSense, it successfully leaves my network and comes back. But… it never attempts to route back to my local box.

Everything in pfSense is default, no ‘deny’ rules, tons of ‘any any’ rules, NAT is Auto, ISAKMP Rules are auto-created, MSS & MTU on LAN & OPT1 are default, IP Do-Not-Frag is NOT selected, Enable Max MSS is NOT selected. Even when I turn off the Firewall (“This convers pfSense into a routing only platform”), it still doesn’t work.

What am I missing?

715×191 19.7 KB

2

Now, when I skip pfSense all together, I connect easily to my Work VPN.

What verison of pfsense are you running?

What pfsense packages do you have running?

Do you see any dropped traffic in the pfsense logs to the public ip address of your company?

What is the purpose of the first router on your network?

3

BINGO! I got it. I did a FIREWALL > NAT > PORT FORWARD with L2TP IP as Source and my Laptop as NAT IP with “None” Filter Rule Association and “Use system default” NAT Reflection.

4

Thank you for offering to help. I figured it out. Watching the packet capture helped out a lot. I don’t know why pfSense didn’t continue forwarding it to my laptop. But, I went ahead and put in a NAT Port Forward and now it works.

5

That should not be required and in the long run may cause more issues than not. IPSec NAT-T should allow it to work just fine.