I know this is possible -- and apparently fairly common with larger companies that don't/can't route private addresses for overlap reasons -- but I can't wrap my head around how to get this to work. I'm playing around with pfSense, Vyatta and a Cisco 5505 right now, hardware-wise.

So here's my setup:

WEST: Vyatta

  • outside:
  • inside:
  • machine a:

EAST: Cisco 5505

  • outside:
  • inside:
  • machine b (webserver):

So what we're trying to do is this: route traffic across the tunnel from machine A to machine B without using private addresses. i.e. makes a TCP request to, and as far as EAST is concerned, it sees a src IP of

On WEST, I have your typical many-to-one Source NAT to translate to and that's confirmed to be working.

Also on WEST, I have the following IPSec config:

  • Local IP:
  • Peer IP:
  • local subnet:
  • remote subnet:

I have the reversed configuration on EAST. What happens when I make a request from machine A to is that the SNAT translates the private address of machine A to and it's routed out (and discarded at the other end) without establishing the tunnel. What I'm assuming is happening is that the inside interface on WEST receives a packet from and since this doesn't match the local subnet defined in the tunnel configuration, it's not processed by the IPSec engine and the tunnel is not established.

How do you make this work? Seems like a chicken and egg thing with the NAT and IPSec and I just can't wrap my head around how this can be done: can I say, "if a packet is received on the inside interface with a destination of, translate it to before the IPSec engine inspects it"?


You need to change port forwarding in order to tell Cisco to route your tcp:80 request to port 80 of machine b ( Otherwise Cisco router doesn't know to which machine the incoming request will go and it will stop it.

  • I have port forwarding configured already. – WuckaChucka Jan 11 '11 at 3:38
  • also on the west side? – Nicola Boccardi Jan 11 '11 at 3:58
  • no. Why would I do that? – WuckaChucka Jan 11 '11 at 4:00
  • sorry, maybe I have misunderstood – Nicola Boccardi Jan 11 '11 at 4:05

Turns it out it does work (when you do the configuration correctly in Vyatta). From their documentation (which uses OpenSWAN), they state that NAT is applied before the IPSec configuration is applied. Not sure if this is relevant for other firewall/routers. Might try it out with a PIX in place of the Vyatta.

  • it varies from vendor to vendor. I can tell you in Juniper land your policies are usually post-nat. – SpacemanSpiff Jan 11 '11 at 5:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.