I have two sites: MAIN (local subnet, external IP: M.M.M.M) and CLIENT (, external IP: C.C.C.C). I created an IPSec tunnel between the sites and both sites can ping computers in both subnets. So far so good.

# ipsec status
Security Associations (1 up, 0 connecting):
tunnel[1]: ESTABLISHED 7 minutes ago,[C.C.C.C]...M.M.M.M[M.M.M.M]
tunnel{1}:  INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c7e6cd30_i ca170c58_o
tunnel{1}: ===

MAIN's external IP address is whitelisted by some resources on the internet (they can only be accessed from MAIN's address). I would like to configure the routing in a way that these resources are accessed by CLIENT's site through that tunnel and MAIN's gateway.

I would normally try doing this by configuring static routing and NAT. The problem here is that I do not have an interfacethat I can use for defining the routes. If I had a VPN server at the MAIN site and VPN client and the CLIENT site, then the VPN client would have some tun interface that I could use to configure what I need.

Can I achieve the same by having an IPSec tunnel between the two sites?


More details follow:

So the connection looks like this: --- --- C.C.C.C/ ---
(Main subnet)         (Main router)        (Client router)      (Client subnet) - Ubiquity router

C.C.C.C/ - simple router with some ports forwarded to - Ubuntu machine in client subnet with IPSec tunnel to

The tunnel works. Both sites can ping each other`s gateways and other machines in the network.

What I now want to achieve is routing packets to particular external IP addresses from through

  • Can you list "exactly" what is there between a host in CLIENT site and a host in MAIN site? This is to determine how to write the route. Also what is the OS you are using? Basically I'm thinking of using static routes inside the host in CLIENT site. Another potential solution may be using a NAT gateway with IP forwarding inside MAIN site. – Notauser Aug 6 at 18:47
  • @Notauser: I added more details. I hope I am clear now. If you still have any questions, do not hesitate to ask. – Michal B. Aug 7 at 5:55
  • Seems to me you would need a custom updown script for strongswan to establish the necessary rules. The client router needs to designate the main router as nexthop for packets from client destined for said external addresses and the main router would need to forward/masquerade for source wiki.strongswan.org/projects/strongswan/wiki/Updown – user188737 Aug 9 at 9:07
  • If tweaking the routers is not an option, but you can use an ip-address on the main network with a client with some router functionality, then you could destination NAT a specific external address on the to the client in the main network and from there masquerade it to the external address. – user188737 Aug 9 at 10:52

So considering the topology I would pick the first option, simply adding a static route in client machines into If the remote resources aren't in the same IP range, you would need to add one route per resource.

For example on a Windows machine: Resource 1 (say :

route add mask -p

Resource 2 (say :

route add mask -p

Then repeat the same thing into, but this time targeting

See here for adding persistent routes in Linux (ubuntu).

I understand this approach is pretty granular and not suitable for high scale networks but it should work pretty well for small home/office use.

As an alternative, considering a dedicated NAT gateway would be more effective if you want to proxy all the traffic. Not only to whitelisting resources.

A last alternative as far as I know would be to build an OpenVPN server (instead of IPSec) in which will proxy all traffic by default. Excellent tutorial here.

Let me know if you have any question.

  • This is the obvious answer. However, I cannot route through ip route add via gives Error: Nexthop has invalid gateway. This is because is not a local IP address. This is due to the nature of IPSec. It would work with OpenVPN, because then I would have a tunnel interface with an interface and IP address from the other subnet. Actually, I had that configured, but it was not stable and I liked the idea of site-to-site tunnel, so that's what I am trying now... – Michal B. Aug 11 at 7:32
  • To workaround that, can you try : ip route add dev tun0 assuming tun0 is your ipsec interface ? – Notauser Aug 13 at 15:09
  • ipsec does not create an interface. If it did, this post would not exist. – Michal B. Aug 14 at 6:20

I am by no means a network specialist, but this sounds like a forced tunneling scenario relating to enterprises wanting to control internet user traffic on managed remote clients via their proxy. In a general approach you might add a static/default route for all internet bound traffic on the client router to be forwarded through the tunnel to your main router, which implies a Site-to-Site VPN tunnel. In your Point-to-Site VPN case I don't see another way than adding a specific route into local client routing table with the public IP as destination with the next hop being the internal IP of the main router.


So it sounds like what's left is to do Source NAT translation since you are able to control your side of the network interface vs theirs. But there is a new extension I didn't really know about till now called NETMAP that I believe is a better fit for what you want:

For Reference: https://netfilter.org/documentation/HOWTO/NAT-HOWTO-6.html#ss6.1 is the SNAT https://netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO-4.html#ss4.4 - is the NETMAP extension

109569 is relatable.

  • NETMAP target allows you to statically map a whole network of addresses onto another network of addresses. It can only be used from rules in the nat table. I do not understand how this can help me route packets to X.X.X.X through the gateway on the other side of the tunnel. Could you elaborate? Possibly list the commands that you would execute, so I could understand your train of thought? – Michal B. Aug 8 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.