NAT / IPSec - Several sites interconnection puzzle

[Bruno Rodrigo]

Hello,
I have the following scenario and I’m completely stuck on how to solve this puzzle. I’ll try to simplify the case and stay macro as the bellow topology cannot be changed because of business restrictions.
We have two LANs in two different sites. SITE 1 and SITE 2 are connected through these two firewalls, FW1 and FW2 using an IPSEC tunnel. All routing works just fine, both sites can communicate seamless.

SITE 1: 10.100.1.0/24
Default Gateway: FW1 - 10.100.1.1 (full internet connectivity)
This is an old IPCOP and can’t be upgraded/changed/substituted at the moment.

SITE 2: 10.99.1.0/24
Default Gateway: FW2 - 10.99.1.1 (full internet connectivity)
PFSense 2.4.4

So this is my present scenario and it works well.

Now we need to provide a client access to a resource on SITE 2 through an IPSEC tunnel and this tunnel needs to stay on SITE 1 for business reasons. For several reasons the client can’t establish the VPN connection with the IPCOP so I added another firewall to the scenario (FW3).
So now we have this scenario.

As this is the first time I deal with case like this, I'm very confused with the options and how to achieve this with PFSense.

I’m trying to have the packets arriving SITE 1 through the tunnel established between the client and FW3 to have some kind of source NAT so they can “belong” to the network 10.100.1.0/24 so they could be routed seamless to SITE 2. Is this possible? What is the best practice (if there is one) for this case? How FW3 should be configured for this scenario?
FW1 is almost immutable, so the chances to have something changed there are very small.
I really appreciate your help.
Regards,
Bruno

[Bruno Rodrigo]

Any one?

[Bruno Rodrigo]

So I believe there is no solution for this scenario using PFSense. Is this right?

[Bruno Rodrigo]

One last try... Is this an impossible approach?
Does anyone knows how to solve this?

Thanks.

[Konstanti]

@bruno-rodrigo said in NAT / IPSec - Several sites interconnection puzzle:

One last try... Is this an impossible approach?
Does anyone knows how to solve this?

Hey
what are the phase 2 settings FW3<-> client ?
I'm interested in leftsubnet/rightsubnet
what are the phase 2 settings FW1<-> FW2 ?
I'm interested in leftsubnet/rightsubnet
which default gateway is FW3 ?
10.100.1.3 can ping 10.99.1.1 or any other host 10.99.1.0/24?