NAT via two PFSense Firewalls connected via IPSec

zulasch

Hey guys,

is it possibile to make a connection from the "User" to the "Webserver" like in the picture above?

I already setup the IPSec tunnel, and I can reach the Webserver via the shell from the FW2 firewall, so VPN is fine.

Now I have created a NAT rule for ther internet users with the following configuration:
Destination: This Firewall, WAN IP or Floating IP (tried all three possibilities)
Destination port range: 443
Redirect target IP: WebserverIPAdress
Redirect target port: 443

but its not working, so I cannot reach out to the webserver with WAN IP or Floating IP...

Is this scenario technicaly possibile?

Thanks
zulasch

viragomann

@zulasch said in NAT via two PFSense Firewalls connected via IPSec:

is it possibile to make a connection from the "User" to the "Webserver" like in the picture above?

No.

zulasch

@viragomann
Why?

viragomann

@zulasch
This would require, that you have defined an SPD for the "users" IP and the webserver in IPSec. But the clients IP is dynamic. So it would only work if you route the whole upstream traffic from the webserver over the VPN, which might not be what you want.

It would work with any other kind of VPN though, which gives you the possibility to assign an interface to. Could be OpenVPN, Wireguard or IPSec VTI.