I have installed strongswan tunnel to Site to Site vpn providing in our datacenter. I have in iptables set up masquerade. That is working fine. But now, I want to setup that same traffic with routing instead nating.

In datacenter I have network /24. In this network I have strongswan server with local ip x.x.x.186/24 and pfsense with local ip x.x.x.1/24. On pfSense I set up gateway and static route to network behind tunnel. If I ping from any PC in datacenter to subnet behind vpn tunnel, evertyhing working, because traffic is going via pfsense.

If I ping from device on other side tunnel to device in datacenter, ping isn't working. When I tried to add static route to network behind tunnel via x.x.x.186 on specific device in datacenter, so is wokring too.

Please, is any way, how to run in via pfsense and routing? Thank you very much!!

1 Answer 1


Short answer: no - you need to tell the end points about the route - at least if the route to the other site is not via the same device which provides the default route.

It might be better to start with some sensible, and concrete examples.

Site A: Site B: VPN:

Router a site A might therefore have IP addresses (LAN) and (VPN). Router B might therefore have (LAN) and (VPN)

A host at site A ( needs a route to site B ( via the local IP of router A ( But only if router@A is not the default gateway.

This gets the packets from the host@A to router@A. But the router@A doesn't know where is. We need to add a route on router A to via the address on the subnet it shares with router B - i.e.

For packets to come back the other way, a host at site B needs a route to site A via the local IP of router B ( - again unless this is the default gateway for site B. And router B needs a route to via

How to provision these routes to the hosts on the network depends on the operating system and whether they use static configurations or DHCP.

  • Thank you, for yours answer.. I forgot to mention, that I have set up default gateway to pfsense on datacenter klients..
    – Dave
    Commented Oct 3, 2023 at 9:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .