GL-E5800 (5G): Network Acceleration Auto/Hardware silently breaks IPsec (IKEv2) on cellular — Software mode fixes it

Router
1

Device: GL-E5800 (Mudi), firmware 4.8.5, modem RG650V-EU (baseband RG650VEUJ00ADR02A04G8G), on a Telekom DE 5G/4G SIM.

TL;DR: A certificate-based IKEv2/IPsec VPN client (NCP Secure Client) on a laptop behind the router could not connect over the cellular WAN. The exact same laptop/client connects fine over Ethernet WAN and over a phone hotspot on the same carrier. Root cause: Network Acceleration in Auto/Hardware mode. Setting Network > Network Acceleration > Mode = Software fixes it completely.

Symptom

IKE_AUTH times out on the client: IKEv2(AUTH) - Could not contact Gateway ... retry timeout - max retries.

Diagnosis (tcpdump on the cellular WAN interface)

  • Outbound IKE (UDP 500 and 4500, incl. NAT-T) leaves the WAN correctly.
  • Zero inbound packets from the gateway are seen at the WAN - not even a reply to the small (~400 byte) IKE_SA_INIT. Since the replies never appear even in tcpdump, they are being discarded by the IPA hardware offload before reaching the Linux/netfilter path.
  • Ruled out: MTU (a ~400 byte INIT never fragments), firewall (ESP/ISAKMP allowed), SIP/IPsec ALG (off), and any carrier/gateway block (a phone hotspot on the same carrier works).

The A/B result (smoking gun)

  • Network Acceleration Mode = Hardware / Auto -> IPsec broken (0 inbound as above)
  • Network Acceleration Mode = Software -> IPsec works (full handshake + ESP)

Fix / workaround

Network > Network Acceleration > Mode = Software (uci: ipacm.global.actype='flow_offloading'). No APN change needed; native IPv6 is preserved; acceleration stays on.

This looks like the same underlying issue as the older (now closed) thread "IPSEC/L2TP thru GL-X3000 not working on 5G NSR carrier". There the workaround was a firmware reset, but that only fixes it temporarily - it clears the offload state until the next re-dial. Mode = Software is the durable fix.

Suggestion

On cellular, "Auto" appears to select the Hardware/IPA path, which silently drops inbound IPsec with no error or indication. Could "Auto" prefer Software on cellular when IPsec is in use, or at least surface a warning that Hardware acceleration is incompatible with IPsec passthrough on the modem data path? This is very hard to diagnose because the drop is invisible even to tcpdump.

4

Hi,

Thank you for providing the detailed test results and feedback.

We have recorded this issue and your suggestions and will forward the information to our development team for further evaluation.
Thank you for providing the Software mode workaround and support.

5

Just to note that I have the same problem and can replicate these behaviors. However, setting it to software doesn’t fix the problem. I have to turn it off entirely for my cellular connection to work correctly.

6

Hi,

When you mention that the cellular connection only works correctly with Network Acceleration disabled, could you please confirm whether only the IPsec/IKEv2 connection is affected, or whether normal Internet access over Cellular is also affected when Software acceleration is enabled?

If possible, please also let us know whether the same IPsec connection works normally when the E5800 uses Ethernet WAN or Repeater instead of Cellular.

Thank you for your help.