Page MenuHomeVyOS Platform

Allow multiple prefixes in ipsec tunnel
Open, WishlistPublicFEATURE REQUEST


Traditionally with IPSec when one site has 2 prefixes you create 2 tunnel configurations under the peer in Vyos.
With Vyos 1.2 and the update to Charon it is possible to use 2 prefixes in one rightsubnet line with a ',' in between.
In ipsec.conf rightsubnet=prefix1,prefix2.

This is needed with Azure virtual gateway since it won't accept the second tunnel configuration but does accept the 2 prefixes in 1 tunnel when working with route-based virtual gateways.

Since Charon accepts it the change would possible be small, only the imput validation has to allow this and add it to ipsec.conf.

Alternate solution would be to implement interface routes like Edgerouter does.
protocols static route prefix1 next-hop-interface vti0
protocols static route prefix2 next-hop-interface vti0

Then we can use that to add the prefixes and use bind vti0 in the VPN configuration.


Difficulty level
Unknown (require assessment)
Why the issue appeared?
Will be filled on close

Related Objects

Event Timeline

Merijn created this task.May 16 2018, 12:54 PM
syncer triaged this task as Wishlist priority.May 27 2018, 9:41 AM
dmbaturin renamed this task from Vyos 1.2 multiple prefixes in ipsec tunnel to Allow multiple prefixes in ipsec tunnel.Sep 2 2018, 9:30 PM
dmbaturin edited projects, added VyOS 1.3 Equuleus; removed VyOS 1.2 Crux.
pasik added a subscriber: pasik.Mar 12 2019, 6:13 PM
syncer assigned this task to Dmitry.Mar 2 2020, 2:47 AM