IPSec VTI incorrect routes

[volga629-1]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• [X ] I have read the contributing guidelines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• [X ] I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue
• AI tools were used to create at least part of the text submitted herewith.

If AI was used, please disclose:

• Model used:
  N/A

Describe the bug
Latest release VTI ipsec tunnels install incorrect routes, which cause tunnel not pass defined traffic.
I found report which from upstream #10512

Steps to reproduce the behavior:
Forum topic describe exactly how to reproduce the issue
https://forum.opnsense.org/index.php?topic=52810.0

Expected behavior

Tunnel traffic will flow based on defined Phase 2 of ipsec configuration ion webui.

Describe alternatives you considered

Currently there are no alternative, because it affecting core functionality.

Software version used and hardware type if relevant, e.g.:

Versions
OPNsense 26.7.2_2-amd64
FreeBSD 15.1-RELEASE-p2
OpenSSL 3.5.7

[volga629-1]

The more closer I am looking on issue, the more I think fix should go into up down python script, which will cover all based for re authentications and retransmissions .

Clarification on expectations and flows
Broken:
10.0.31.2 -> gateway 10.0.31.1 -> lo0

After deleting it:
10.0.31.2 -> default route -> igb0

Manual fix:
route add -host 10.0.31.2 -iface ipsec10

Result:
VTI ping works
traffic passes both directions
BGP establishes

[fichtner]

If this pertains to lo0 can you at least post your

# ifconfig lo0

to see if the patch in #10512 is in effect?

[volga629-1]

Lo0

root@fw01:~ # ifconfig lo0
lo0: flags=1008049<UP,LOOPBACK,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 16384
        options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
        inet 127.0.0.1 netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5
        groups: lo
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
root@fw01:~ # 

[fichtner]

that part looks ok, thanks

# route get 10.0.31.2

how about this?

[volga629-1]

First one that correct ( adjusted manually )
Second one after reload from web ui ( that incorrect pointed to lo0 )

root@fw01:~ # route -n get 10.0.31.2
   route to: 10.0.31.2
destination: 10.0.31.2
        fib: 0
  interface: ipsec10
      flags: <UP,HOST,DONE,STATIC>
 recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
       0         0         0         0      1400         1         0 
root@fw01:~ # route -n get 10.0.31.2
   route to: 10.0.31.2
destination: 10.0.31.2
    gateway: 10.0.31.1
        fib: 0
  interface: lo0
      flags: <UP,GATEWAY,HOST,DONE,STATIC>
 recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
       0         0         0         0     16384         1         0 
root@fw01:~ # ping 10.0.31.2
PING 10.0.31.2 (10.0.31.2): 56 data bytes
92 bytes from 127.0.0.1: Time to live exceeded
Vr HL TOS  Len   ID Flg  off TTL Pro  cks       Src       Dst
 4  5  00 0054 8348   0 0000  01  01 0000 127.0.0.1 10.0.31.2

92 bytes from 127.0.0.1: Time to live exceeded
Vr HL TOS  Len   ID Flg  off TTL Pro  cks       Src       Dst
 4  5  00 0054 a21e   0 0000  01  01 0000 127.0.0.1 10.0.31.2

^C
--- 10.0.31.2 ping statistics ---
2 packets transmitted, 0 packets received, 100.0% packet loss
root@fw01:~ #

[fichtner]

can you share # ifconfig ipsec10 too? yes this looks the same but it can't be the exact same issue. maybe one of these netmask missing, freebsd deciding to use a different netmask then

[volga629-1]

They not the same assigned interface is different, VTI tunnels routes should be not pointed to loopback .

ipsec10: flags=1008051<UP,POINTOPOINT,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 1400
        description: IPSECVTI10 (ipsec10)
        options=0
        tunnel inet my_pub_ip --> remote_pub_ip 
        inet 10.0.31.1 --> 10.0.31.2 netmask 0xfffffffc
        groups: ipsec
        reqid: 10
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
root@fw01:~ #