1

I'm having a hard time figuring out how to configure 1:1 NAT between my local LAN and a remote subnet connected through IPSec.

I have a fresh install of pfSense-2.4.5p1, with a public IPv4 on WAN and 192.168.10.1/24 on my LAN.

I also have an IKEv2 IPSec established with a remote site with Phase2 configured between "Local Network = LAN subnet" and "Remote Network = 192.168.20.0/24".

From pfSense SSH shell I can ping successfully a remote host with "ping -S 192.168.10.1 192.168.20.123". So far so good.

Now I need to achieve this:

  • when a host on my LAN sends packets to 192.168.99.123, it should be NATted to destination 192.168.20.123 and sent through IPSec
  • when the remote host 192.168.20.123 sends packets to an host on my LAN, it would be NATted with source ip 192.168.99.123 and sent to my LAN

Basically I want the remote 192.168.20.xx subnet to appear as 192.168.99.xx to my LAN. As far as I know this is not achievable with "NAT/BINAT translation" in the IPSec Phase2 configuration, so I tried various combinations in Firewall > NAT > 1:1 without any luck.

How could I achieve what I described above? Any help would be appreciated.

Offtopic note: if anyone reading this is also on Netgate's pfSense forum, I was unable to post this question there nor reply to an existing thread because anything I write gets flagged as spam by their Akismet filter.

0

You must log in to answer this question.

Browse other questions tagged .