[CentOS] Libreswan IPSec Protected GRE Tunnel & firewall-cmd

Tue Apr 24 18:18:10 UTC 2018
Adam Tauno Williams <awilliam at whitemice.org>

I am attempting to setup an IPSec protected GRE tunnel with a Cisco
router.  I believe the IPSec association is up, however I cannot move
traffic over the tunnel.

It is not clear how to integrate the tunnel interface (gre1) with
firewall-cmd; adding the interface to trusted does not appear to

[root at aqueduct ~]# firewall-cmd --add-interface=gre1 --zone=trusted
The interface is under control of NetworkManager and already bound to
The interface is under control of NetworkManager, setting zone to
[root at aqueduct ~]# firewall-cmd --list-all --zone=trusted
  target: ACCEPT
  icmp-block-inversion: no
  interfaces:    <<<< nothing

No traffic ever appears to be received by the GRE interface.

6: gre1 at NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1460 qdisc noqueue
state UNKNOWN qlen 1
    link/gre A.B.C.D peer X.Y.W.Z
    inet peer scope global gre1
       valid_lft forever preferred_lft forever
    inet6 fe80::200:5efe:4acc:1a64/64 scope link 
       valid_lft forever preferred_lft forever
[root at aqueduct ~]# ifconfig gre1
gre1: flags=209<UP,POINTOPOINT,RUNNING,NOARP>  mtu 1460
   inet  netmask  destination
   inet6 fe80::200:5efe:4acc:1a64  prefixlen 64  scopeid 0x20<link>
    unspec 4A-CC-1A-64-00-00-F0-00-00-00-00-00-00-00-00-00  txqueuelen
   RX packets 0  bytes 0 (0.0 B)
   RX errors 0  dropped 0  overruns 0  frame 0
   TX packets 146  bytes 12180 (11.8 KiB)
   TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Adam Tauno Williams <mailto:awilliam at whitemice.org> GPG D95ED383
OpenGroupware Developer <http://www.opengroupware.us/>