SNAT Prerouting

[barts]

Hi guys!

I've been trying to make a simple SNAT configuration that I see works fine in FortGate/FTD/Checkpoint/Untagle/MikroTik but I cannot make it works in PFSense.

That's my scenario:

How can I make a SNAT with an IP address that don't exists in PFSense?

I've tried creating a Virtual IP address 10.10.10.10/32 on the inside interface and make Outbound NAT on the same inside interface using this virtual IP, but the packet goes out through the public-outside interface. It should makes the SNAT and encapsulate into the IPSec Tunnel.

Someone knows how to configure it?

Thank you so much!

[viragomann]

@barts
You have to do this inside IPSec using PNAT: NAT with IPsec Phase 2 Networks

You can directly enter the server IP and a unused translation IP like 10.10.10.10 which is routed back to you.
There is no need to assign that IP to an pfSense interface.

[barts]

Works by doing the NAT configuration on the IPsec Phase 2 and a static route to the remote subnet pointing to inside interface.

NAT with IPsec Phase 2 Networks
Routing and gateway considerations

Thank you so much, @viragomann.