I've been trying to join two networks (A) 172.17.0.0/22 and (B) 10.80.0.0/14 with IPSEC and pfsense. So that computers on the (A) network can connect to computers on the (B) network.
No big deal, but on the (B) network, packets must come from a specific NATed address, otherwise network (A) would overlap with other networks from (B) point of view.
So I configured an IPSec VPN using my favorite tool (pfsense), the phase 1 tunnel fonctions properly, but the phase 2 configuration, although good looking, does not functions properly :
- The problem is that captured packets on network (B) don't have the NATed address as origin, but a network (A) address (must trust other people's word on this I cannot confirm this myself)
- The packets captured within pfsense don't show the NATed address either, but the documentation states that this is normal in the caveat section (https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/nat-with-ipsec-phase-2-networks.html).
- Local network : the network (A)
- NAT Address : A single IPV4 choosen by administrator
Remote network : the network (B)
Is this configuration sufficient ? or does it needs extra outbound NAT rules ? I could not find a recent example or tutorial with the NAT option working on pfsense.
Found similar problem here : https://forum.netgate.com/topic/147373/nat-and-ipsec