0

We are integrating with a third party and they require the use of a L2L IPSec VPN for communication. I have successfully configured the IPSEC vpn and the tunel is up but now I cannot seem to have traffic pass through it because the source IP address is not correct (I assume). I am a software guy not a network guy so

The third party has required us to use subnet 172.31.168.0/24 but this conflicts with our internal addressing (AWS VPC) of 10.0.11.0/24. I added a 1:1 NAT for

  • source: Any
  • dest: <external encryption domain>
  • external : 172.31.168.0/24

but doing a traceroute from the pfsense machine to an ip in the encryption domain range sends the traffic out over the internet.

I have setup a app servers default route to be the PFSense box and I can see the app server connecting to external services in the firewall log but no ipsec related stuff?

Is what I am trying to do even possible?

Using PFSense version 2.1.5-RELEASE (amd64)

2 Answers 2

1

but doing a traceroute from the pfsense machine to an ip in the encryption domain range sends the traffic out over the internet

This is a clear indication that you do not have your IPsec Phase 2 entries configured correctly. IPsec matches traffic purely on source/dest IP subnet, and if it's not sending your desired traffic down the tunnel, you have a P2 configuration problem.

1
  • Internal addresses are in 10.0/16, required to be in 172.31 for site b, this is what I'm trying to mangle. I need to NAT the traffic in all local subnets where the packet dest is the siteb encryption domain to the correct site a encryption domain subnet before re routing packet over ipsec.
    – David Mann
    Mar 4, 2015 at 22:46
0

Okay, the solution to this was to remove all the NAT rules from PFSense and put the actual local subnet as the local domain in pfsense phase 2 entry on site A, then put the encryption domain as the "address to translate".

Route traffic from app servers through pfsense and anything destined for site B enc domain will be routed over ipsec!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .