Need help with complicated routing & ipsec setup

[ms (Michael Tremer)]

@markusb

First of all, is a constellation like the picture even possible?

I think the short answer is yes. But you will have some issues here…

@markusb

Can I add multiple distinctive IPSec routers behind a single IPFire, while IPFire itself is also handling IPSec tunnels?

Not really. You won’t be able to have the remote site initiate the connection to your routers in your orange network. You could get away with that by assigning each router a different public IP address, but that would entail that you have a small subnet with public IP address space available.

You should use the IPFire box to handle all IPsec VPNs in my opinion.

@markusb

I am thinking about a CUSTOMPREROUTING and CUSTOMPOSTROUTING rule in firewall.local to redirect traffic from Customer2 and Customer3 to the corresponding IPSec router.
I tried this already in a test case, but it didn’t work.

I have no idea why you needed to setup firewall rules on the console. The web UI can do that for you.

You probably didn’t setup any static routes.

@markusb

That didn’t work, the router couldn’t establish an ipsec link with a timeout error.
Then I tried adding custom IPTables rules:
iptables -t nat -A CUSTOMPREROUTING -i red0 -s Customer -j DNAT --to IPSec Router
iptables -t nat -A CUSTOMPOSTROUTING -o red0 -d Customer -j SNAT --to IPSec Router

This is not how networks or routing works.

@markusb

My second question is, how does IPSec with a virtual network work in IPfire?
We have one customer, cutomer1 in the first image, who uses a “virtual transfer network” for the IPSec tunnel.

Unless your customer is AT&T, you are using public address space here - for starters.

What is a “virtual” network? Aren’t they all quite virtual?

You have a very complicated setup here and since you are using this in some business, I can only ask you learn how basic routing works or have an expert have a look at it.