Due to bad design and hosting provider constraints I have a network where I don't control the router.

Our network: - LAN x.x.x.0/24 - WAN (Router is connected to the switches, we have no control over it) - IPSec client network - PFsense internal IP x.x.x.251/24 - PFsense internet IP

We're using PFSense 2.2.6.

I have configured IPsec remote access using this guide: https://doc.pfsense.org/index.php/IPsec_Road_Warrior/Mobile_Client_How-To

It works fine as long as I add static route to destination server (ip r add via Ofcourse it'll not work in any other situation because my main router isn't familiar with PFsense, or anything in the LAN segment. It only has interface in the WAN subnet.

Is there a way to make my remote clients have IP within the subnet once they connect? Can I NAT their traffic from to some address at

Please see attached diagram. Green side is LAN. I'd like to achieve NAT from the tunnel network ( to LAN ( using LAN IP.


Network Diagram

  • A diagram of the network would make this question easier to understand. – kasperd Apr 5 '16 at 14:22
  • Still not entirely clear to me. I cannot figure out which parts of the text applies to which nodes in the diagram. – kasperd Apr 6 '16 at 9:13

Found the solution.

Created Outbound NAT rule on the LAN interface. Source is tunnel network, destination is LAN network.

Source IP is always firewall IP, but that's something I can live with.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.