VPN and NAT conflicts
-
I have installed PfSense on a VM (Hyper-V) and it works just fine for NAT, VoIP, and firewalling. However, I am encountering issues when trying to set up an L2TP VPN. PfSense is continuously throwing the following error:
There were error(s) loading the rules: /tmp/rules.debug:73: could not parse host specification - The line in question reads [73]: no nat on l2tp proto tcpThe LAN has a scope of 10.10.0.0/16 with reserved (static) addresses between 10.10.10.1 and 10.10.12.254. The range 10.10.13.1-254 is served by DCHP. In the L2TP configuration page, I am assigning 10.10.9.1. to the "server address", 10.10.0.0/16 to the remote address range, and CHAP. The client uses the Windows10 bundled L2TP client protocol.
I have read that PfSense seems to have a bug that creates wrong firewall rules if there is a NAT that is included in the address range of the VPN. But how can I possibly avoid that? If I use a 16bit subnet mask, it seems unavoidable that any NAT rule will fall within this subnet. What am I doing wrongly? Any help would be greatly appreciated!
-
…and here is the potential bug that I was talking about: https://redmine.pfsense.org/issues/4772. I should add that I did enable NAT reflection, and I would very much like to keep it on!