Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two networks: Local and Remote

On the local network I have installed pFsense as gateway. On the remote network there is a Cisco ASA that I don't have control over. (It's a hosting company's.)

They're saying that I have to masquerade my all local traffic under my public IP address for proper tunnel work. I have no idea how to do it.

I've tried to use a virtual IP, but pFsense does not allow me to use my public IP address as virtual.

As I understand it, IPSEC hits before NAT, and so traffic arrives to the hosting company not masked, so it doesn't have a route back.

share|improve this question
up vote 1 down vote accepted

After all - this feature was presented in pFsense 2.1 - to make BINAT before IPSEC, this will allow to masquerade all traffic under specific IP and afterthat send it to tunnel.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.