I'm having a hard time figuring out how to configure 1:1 NAT between my local LAN and a remote subnet connected through IPSec.

I have a fresh install of pfSense-2.4.5p1, with a public IPv4 on WAN and on my LAN.

I also have an IKEv2 IPSec established with a remote site with Phase2 configured between "Local Network = LAN subnet" and "Remote Network =".

From pfSense SSH shell I can ping successfully a remote host with "ping -S". So far so good.

Now I need to achieve this:

  • when a host on my LAN sends packets to, it should be NATted to destination and sent through IPSec
  • when the remote host sends packets to an host on my LAN, it would be NATted with source ip and sent to my LAN

Basically I want the remote 192.168.20.xx subnet to appear as 192.168.99.xx to my LAN. As far as I know this is not achievable with "NAT/BINAT translation" in the IPSec Phase2 configuration, so I tried various combinations in Firewall > NAT > 1:1 without any luck.

How could I achieve what I described above? Any help would be appreciated.

Offtopic note: if anyone reading this is also on Netgate's pfSense forum, I was unable to post this question there nor reply to an existing thread because anything I write gets flagged as spam by their Akismet filter.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.