Hello misc!
I'm is search for some help, I need to understand how ipsec rules work.
Unfortunately, fancy artificial intelligence tools cannot help me, so
maybe someone with natural intelligence can.
Let's assume we have two hosts with iked configured like this:
host1 iked.conf:
ikev2 esp from 1.1.1.1 to 2.2.2.2 peer 2.2.2.2
pf.conf on host1:
pass on egress from 192.168.0.0/24 to any nat-to egress
and another host2:
iked.conf:
ikev2 esp from 2.2.2.2 to 1.1.1.1 peer 1.1.1.1
pf.conf on host2:
pass on egress from 10.0.0.0/24 to any nat-to egress
the configs are absolute real, except for ip addresses, both hosts are
routers with no additional unusual configuration. Just nat and some
ports opened (500, 80, 443)
When iked is off, lan network 192.168.0.0 can access 2.2.2.2 through
wan. And 10.0.0.0 can access 1.1.1.1 through wan.
But when iked is launched, only 1.1.1.1 and 2.2.2.2 can access
one-to-another, and 192.168.0.0 can no longer access 2.2.2.2 and
10.0.0.0 cat no longer access 1.1.1.1
To fix it, usually we need to create to additional rules in iked:
ikev2 esp from 192.168.0.0/24 to 2.2.2.2 peer 2.2.2.2
and
ikev2 esp from 10.0.0.0/24 to 1.1.1.1 peer 1.1.1.1
The question is: why?
Why not having this rules breaks networking between lan and remote host?
