Routing selective outbound NAT traffic through IPSEC

[trueinnovation]

Hi,

We're expanding outside of our colo due to capacity constraints. We operate a number of transaction servers which communicate with customer systems. The customer systems are only open to our trusted IP range at the main colo facility.

What we need to do is tunnel traffic back from the overflow site to our main colo facility, then out via an outbound NAT rule to our customer sites. This should only apply to certain destinations, or even better for certain ports.

IPs altered to protect networks
PFSense at Main Colo
External IP range 127.1.1.96/28
Internal IP range: 10.140.21.0/24

PFSense at Secondary Colo
Exterrnal IP range: 127.2.2.0/28
Internal IP range: 10.140.20.0/24

We have a solid IPSec tunnel between 10.140.20.0/24 and 10.140.21.0/24. No problems with one-way traffic, everything is perfect.

Example transaction server 1 at overflow site: Internal IP: 10.140.20.10
Need to send all traffic to 52.1.1.1 through main site IP 127.1.1.100  using outbound NAT on primary site.

Any suggestions on a good IPSEC /  NAT ruleset to get me started?

Thanks!

[Derelict]

OpenVPN will be a lot more flexible for that.