Bug 273198

Hi, I have setup site to site IPSEc between FreeBSD 14.0 Current and Palo Alto includes NAT with IPsec Phase 2 Networks

NAT allows remote host to directly contact local host using their equivalent NAT addresses, provided that IPsec rules allow the traffic to pass.

My Configuration:

VPN GW : FreeBSD 14 CURRENT
IP Adress: 65.65.65.2
Auth Method: PSK
DH Group:DH14 (2048)
Encryption Algorithm: AES-256
Hash Algorithm: SHA-256
Mode: Main
SA Life Time: 86400 sec
Encapsulation: ESP
<Phase2>
Encryption Algorithm: AES-256
Hash Algorithm: SHA-256
PFS: Enable, DH14 (2048)
SA Life Time: 3600 sec
Encrypted Domain: 85.85.85.86
NAT IP: 192.168.1.100

strongswan conf:
local_ts = 85.85.85.86/32|192.168.1.100/32
remote_ts = 75.75.75.76/32

#############################

Remeote Side Configuration:

VPN GW : FreeBSD 14 CURRENT
IP Adress: 55.55.55.38
Auth Method: PSK
DH Group:DH14 (2048)
Encryption Algorithm: AES-256
Hash Algorithm: SHA-256
Mode: Main
SA Life Time: 86400 sec
Encapsulation: ESP
<Phase2>
Encryption Algorithm: AES-256
Hash Algorithm: SHA-256
PFS: Enable, DH14 (2048)
SA Life Time: 3600 sec
Encrypted Domain: 75.75.75.76
NAT IP: 192.168.250.100

Our local encryption domains behind nat, so if the remote peer wants to send data to my server (192.168.1.100) first the data arrives at 85.85.85.86 and then is redirected to 192.168.1.100:
# IPSec virtual interface to LAN Redirect rule
rdr log(all) on { enc0 } proto { tcp } from { 0.0.0.0/0 } to { 85.85.85.86/32 }  port { 80 }  -> 192.168.1.100 port 80 

The problem is:
When remote peer's server (192.168.250.100) tries to send data to me, PF recognizes it as coming from WAN (em0) you can see the pflog0 logs shown below
But remote peer's traffic must come from enc0

root@test~ # tcpdump -ttt -n -e -i pflog0 action block
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on pflog0, link-type PFLOG (OpenBSD pflog file), snapshot length 262144 bytes
 00:00:00.000000 rule 2048/0(match) [ridentifier 100000001]: block in on em0: 192.168.250.100.40900 > 85.85.85.86.80: Flags [S], seq 2765053457, win 1024, length 0

If i write a em0 pass rule for Remote Peer Server IP, connection continues as expected
But why traffic comes from WAN(em0)?
# PF 
pass in log(all) quick on { em0 }   inet  from {  192.168.250.100/32 } to {  192.168.1.100/32 }   flags S/SA keep state ridentifier 37


#DEFAULT NAT RULES
nat log(all) on em0 inet from { !em0 } to any port 500 -> (em0:0) static-port #static-port -> for_ipsec
nat log(all) on em0 inet from { !em0 } to any -> (em0:0) port 1024:65535

#IPSec Allow Rule
pass out log (all) quick route-to ( em0 65.65.65.1 ) proto udp from any to 55.55.55.38 port = 500 keep state label "ipsec_vpn_1_500"
pass in log (all) quick on em0 reply-to ( em0 65.65.65.1 ) proto udp from 55.55.55.38 to any port = 500 keep state label "ipsec_vpn_1_500"
pass out log (all) quick route-to ( em0 65.65.65.1 ) proto udp from any to 55.55.55.38 port = 4500 keep state label "ipsec_vpn_1_4500"
pass in log (all) quick on em0 reply-to ( em0 65.65.65.1 ) proto udp from 55.55.55.38 to any port = 4500 keep state label "ipsec_vpn_1_4500"
pass out log (all) quick route-to ( em0 65.65.65.1 ) from any to 55.55.55.38 keep state label "ipsec_vpn_80_esp"
pass in log (all) quick on em0 reply-to ( em0 65.65.65.1 ) from 55.55.55.38 to any keep state label "ipsec_vpn_80_esp"

# enc0 pass all
pass in log(all) quick on { enc0 }   inet  from {  any } to {  any }   flags S/SA keep state ridentifier 5

# setkey -DP
192.168.1.100[any] 75.75.75.76[any] any
	out ipsec
	esp/tunnel/65.65.65.2-55.55.55.38/unique:1
	created: Aug 18 05:52:51 2023  lastused: Aug 18 09:33:50 2023
	lifetime: 9223372036854775807(s) validtime: 0(s)
	spid=13254 seq=36 pid=2553 scope=global 
	refcnt=1
75.75.75.76[any] 85.85.85.86[any] any
	in ipsec
	esp/tunnel/55.55.55.38-65.65.65.2/unique:1
	created: Aug 18 05:52:51 2023  lastused: Aug 18 05:52:51 2023
	lifetime: 9223372036854775807(s) validtime: 0(s)
	spid=13253 seq=941 pid=2553 scope=global 
	refcnt=1