Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a pfSense firewall and I need to connect to a remote site (form my client). I'm running into several issues, and don't see traffic flowing in any way.

Here's my setup:

  • LAN is
  • I have a WAN interface as the default gateway.
  • I have a WAN2 interface, that I'd like to use for the tunnel to the remote site.
  • The remote site is asking my to connect using local IPs of, as the won't be able to route my traffic otherwise. Their IP range (remote) is

This is what I did already

  • Set up the IPSec tunnel. This works, and I can connect.
  • I created a Virtual IP (Firewall -> Virtual IPs) of type IP Alias, in the LAN interface with IP Addresses of
  • I added routes in System -> Routing, so goes through WAN2. Same for, I added a route for that traffic to go through WAN2.
  • On Firewall -> NAT, Outbount, I created a rule for WAN2, source, Destination and Translation Address the IP Alias I created (

With all this setup, I can't connect to any remote address. Even more, I don't see the tunnel connecting, so I guess it's not getting the traffic it needs.

I'm also not seeing any useful information in the firewall log.

Am I doing things right? (or slightly close to right?).

share|improve this question
up vote 1 down vote accepted

You can't NAT like that, it hits IPsec before the NAT. You'll have to use 2.1 and its IPsec NAT capabilities in the phase 2. You can only map a /24 to a /24 so you won't be able to map your entire internal /16 to that /24, only a /24 out of the /16.

share|improve this answer
Thank you. I'll updated pfSense and post a comment if it works. – pgb Jul 2 '13 at 13:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.