Issues with GlobalProtect VPN behind pfSense

VPN
1

So I have a really weird issue I’m pulling my hair out about. I have a macbook with GlobalProtect VPN on it and behind my pfsense box (which is the router for my whole apartment) it can connect to the endpoint, however while connected to the vpn it cannot complete an ssh connection or an SSL handshake (maybe other things, but the resources behind the VPN I’m trying to access only offer these).

If I take an ethernet dongle and connect my macbook directly to the internet (bypassing pfsense et al) it all works. If I use my pocket wifi it all works. I’m not sure what’s going on.

The SSH one is particularly weird because it can do some of the initial handshake like get the host key, but hangs when it’s time to show me the password prompt/complete the client key handshake.

Any insight would be appreciated, thank you.

Edit: Setting the MTU on the tun interface for GP to 1300 has fixed the problem.

2

You gonna have to provide more detail about your network traffic’s firewall rules. I have pfsense and GlobalProtect and it works fine for work here.

3

Is GlobalProtect configured to use IPsec or SSL?

From Pfsense’s point of view, it shouldn’t matter as it’s only seeing either IPsec or TLS traffic.

Do you have an IPS configured on Pfsense?

4

Full or split tunnel?

Are your remote subnets the same as your local subnets?

5

Everything is pretty default rules wise. On the NAT side it’s in hybrid mode but I haven’t manually put in any rules.

6

ipsec. The admin turned on the toggle for SSL but the checkbox won’t stay checked for some reason so it’s still IPsec as far as I know.

No IPS, snort isn’t even installed at all. Things are pretty default on my box.

7

It’s a full tunnel (as much as I’d like it to be split, I have no control over this one). My local is a 192.168 and the remotes are 10.0 so they’re different.

8

I’ve seen some weird things happen when IP fragmentation occurs (eg. MTU is too big). Maybe you can try to decrease the MTU on the GP interface to something like 1300 and see if the issue still occur.

Maybe this can help you do it on macos.

9

setting the mtu to 1300 (from 1400 on the tun) worked. That’s so weird and such a dumb simple ‘fix’ for something I’ve been pulling my hair out about for a few days.

Thank you so much!

10

Glad you got it working!