I hope someone here can shed light on an infuriating problem I’ve spent a week 
trying to resolve without luck.

The problem concerns an IKED site-to-site VPN on OpenBSD 6.3 (both endpoints 
fully syspatched).

The VPN worked absolutely perfectly until it suddenly started behaving 
strangely.  Seriously, I’m talking about “pass any traffic you can think of”, 
then I go on holiday for a week (nobody else has physical or remote access to 
the machines, and I did not connect on holiday), then this behaviour starts.

Basically the behaviour I am seeing is that anything that uses TLS is no longer 
able to connect (or at least gets no further than trying to do a TLS handshake, 
e.g. Firefox hangs showing "performing TLS handshake..." at the bottom of the 
screen), so that means:

- HTTPS websites
- VoIP
- IMAP over TLS
- RDP over TLS

Are all broken on the VPN, but all TLS-based services continue to work 
perfectly off-site (or when the site-to-site VPN is bypassed with a third-party 
VPN).  This impacts multiple servers and multiple clients, so its not just one 
server or one desktop PC, its anything that tries to talk TLS over that VPN !

- Ping (including large packet size, e.g. “-s 1600”)
- Anything else you care to name that doesn’t use TLS

All continue to work perfectly over the VPN.

My PF rules (which cannot possibly be the problem, because they have not 
changed a single bit between “working” and “not working) don’t even 
differentiate between traffic types, so it can’t be some sudden PF oddity :

pass in on enc from <remote_vpnets> to <local_vpnets> keep state (if-bound) 
pass out on enc from <ocal_vpnets> to <remote_vpnets> keep state (if-bound) 

Similarly, my IKED config is also completely unchanged between "working" and 
"not working", and ipsecctl -sa continues to show everything correctly 

ikev2 "to remote" active esp from $a_net to $b_net\
        local $local_ext peer $remote_ext \
        ikesa auth hmac-sha2-512 enc aes-256 prf hmac-sha2-512 group curve25519 
        childsa enc chacha20-poly1305 group curve25519 \
        srcid $local_ext dstid $remote_ext \
        ikelifetime 4h lifetime 3h bytes 512M \

This whole thing is just driving me crazy !

Reply via email to