IPsec to pfsense and then have internet through airvpn

[Stack of computer parts 9]

Through some terrible fits of headbanging I have managed to establish an IPsec connection between a mobile device and a pfsense box. The box has regular WAN, and is configured like in the how-to section to have airvpn-lan and wan. The ipsec calls the server via its WAN IP, exchanges credentials via much handshaking and hobknobbing, and then allows the mobile to access the internet anywhere via the pfsense box.

 

The problem is that it is through the WAN IP which is clearnet.

 

I would like have the ipsec client exit the pfsense box via the airvpn connection.

 

To get my current setup working I have the firewalls set up as

Firewall->Rules->IPSEC

proto(IPV4) Source/port/destination/port/gateway(Any)

 

Firewall->NAT->Outboound

Interface(WAN) Source(30.0.0.0/24) SourcePort/Destination/DestinationPort(Any) NAT Address (WAN Address) NAT port (Any) Static (No)

 

The outbound rule is enabling the ipsec client to connect to the web. Changing the NAT address to anything other than WAN results in an error on the client "Host name resoution error".

 

How would one get the ipsec client to enter the pfsense box and leave via the airvpn connection?

[Stack of computer parts 9]

Ok got this part working but its a leaky connection.

 

For anyone elses needs once you have a working IPSEC connection you need to add a rule under IPSEC for

(allow) ipv4 * * * * AirvpnWAN(gateway)

(block) ipv6

 

and for nat outbound you need to use

AirvpnWAN  30.0.0.0(or whatever your chosen ipsec subnet is) * * * AirvpnWan address

 

I had to specify to use airdns the automatic setting did not work.

However I am still getting webrtc hits for an rfc6598 address, as well as two what look like ipv6 addresses, they are quite long. Despite my blocking ipv6 from the firewall. Formatted like xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx. Any idea how to block these?

 

However I still get some hits on ipleak.net under