Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NAT via IPSec VPN

    Scheduled Pinned Locked Moved NAT
    natvpnipsec routing nfirewall
    4 Posts 3 Posters 848 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tompark
      last edited by

      Hi Guys,

      I'm having an issue where I am trying to NAT port 443 to an IP Address on my IPSec VPN. I am trying to map my public IP 91.X.X.2 to IP 10.202.10.20.

      My PFSense has a IPSec VPN Tunnel which routes all traffic for 10.202.10.0/24 to Site B.
      In theory should this work?
      If this should work does PFSense v2.3 and 2.4 support this?

      Regards,

      1 Reply Last reply Reply Quote 0
      • T
        TehMuffinMoo
        last edited by

        Hi @tompark

        There's no reason why this shouldn't work. The NAT should be applied on your WAN interface where the Public IP is, at which point it will be translated on the fly and routed internally. PfSense shouldn't really care where the NAT'd destination is, as long as it has routes to get to it.

        I've applied this on a number of OpenVPN links I have, though IPSec should work the same.

        Regards,
        ~Mat

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          The pfSense at the other side will not have a phase 2 back to the source address.

          You cannot outbound NAT like that on IPsec. This does not even work on the new VTI routed IPsec coming in 2.4.4.

          OpenVPN can do this, however.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • T
            TehMuffinMoo
            last edited by

            I stand corrected!😊

            ~Mat

            1 Reply Last reply Reply Quote 0
            • First post
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.