Routing selective outbound NAT traffic through IPSEC

  • Hi,

    We're expanding outside of our colo due to capacity constraints. We operate a number of transaction servers which communicate with customer systems. The customer systems are only open to our trusted IP range at the main colo facility.

    What we need to do is tunnel traffic back from the overflow site to our main colo facility, then out via an outbound NAT rule to our customer sites. This should only apply to certain destinations, or even better for certain ports.

    IPs altered to protect networks
    PFSense at Main Colo
    External IP range
    Internal IP range:

    PFSense at Secondary Colo
    Exterrnal IP range:
    Internal IP range:

    We have a solid IPSec tunnel between and No problems with one-way traffic, everything is perfect.

    Example transaction server 1 at overflow site: Internal IP:
    Need to send all traffic to through main site IP  using outbound NAT on primary site.

    Any suggestions on a good IPSEC /  NAT ruleset to get me started?


  • LAYER 8 Netgate

    OpenVPN will be a lot more flexible for that.

Log in to reply