I have a pfSense Router, which is the endpoint of a site-to-site IPSec VPN. In the pfSense the main LAN Interface is and it has a virtual IP
The IPSec Phase 2 connects the (from the other side) to the network.
Now I want to connect to an ip from the other side, but from an ip in the network

So the desired connection is to
I tried to add the as a gateway in the pfSense and route all traffic to the other network over it, when i did so i could ping the other side from the pfSense host but not from the network.
I tried to add Outbound NAT, but that didn´t helped either.

What am I doing wrong?



Duplicate your existing P2 (click the + to the right of it), change local from, leaving same remote. Do the same, flipping local and remote, on "other router." Then you'll be able to communicate between.

  • Thanks for that, but the problem is that I don´t have access on the other side, so my question is if i can nat that traffic through the pfSense But outbound nat didn´t work (or i made it wrong) – W4rlock Jul 6 '15 at 5:40
  • If you only need egress traffic to that VPN, yes. Add another P2 only on your side, make the NAT subnet and local – Chris Buechler Jul 8 '15 at 23:38

It took me some time, but here is the answer: Edit the P2 in pfSense, set Local Network to: Network /24 (the network where the clients actually reside) and set NAT/BINAT translation to: Network /24

So the VPN tunnel will be established between the remote Network and /24 but the clients from /24 can connect and are nated via this option.

I only tested this if the connection is initalized from my side, I don´t know if the remote site can establish the connection

  • you really should have two phase2 entries, simplifies configuration, debugging, troubleshooting even if the functionality really were the same. – sjas May 23 '17 at 15:19

You can have more than one P2. you should have two phase2 entries on both sides one per block.

  • 2
    Welcome to ServerFault. Did you read the other answers? – chicks Apr 15 '17 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.