1

I'm having a hard time figuring out how to configure 1:1 NAT between my local LAN and a remote subnet connected through IPSec.

I have a fresh install of pfSense-2.4.5p1, with a public IPv4 on WAN and 192.168.10.1/24 on my LAN.

I also have an IKEv2 IPSec established with a remote site with Phase2 configured between "Local Network = LAN subnet" and "Remote Network = 192.168.20.0/24".

From pfSense SSH shell I can ping successfully a remote host with "ping -S 192.168.10.1 192.168.20.123". So far so good.

Now I need to achieve this:

  • when a host on my LAN sends packets to 192.168.99.123, it should be NATted to destination 192.168.20.123 and sent through IPSec
  • when the remote host 192.168.20.123 sends packets to an host on my LAN, it would be NATted with source ip 192.168.99.123 and sent to my LAN

Basically I want the remote 192.168.20.xx subnet to appear as 192.168.99.xx to my LAN. As far as I know this is not achievable with "NAT/BINAT translation" in the IPSec Phase2 configuration, so I tried various combinations in Firewall > NAT > 1:1 without any luck.

How could I achieve what I described above? Any help would be appreciated.

Offtopic note: if anyone reading this is also on Netgate's pfSense forum, I was unable to post this question there nor reply to an existing thread because anything I write gets flagged as spam by their Akismet filter.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.