• Hello, I have a network as seen in the graph, where it is at first only had the network connects to my Pfsense and is one to a VPN Tunnel through IPSec to another network, the problem that I now have is I have another segment of red and I also want this pass through the tunnel, but you can not because the VPN only negotiates with IPs of the red, how can I solve it?
    Note: within the policies on the other side of the tunnel only one segment of the tunnel is included so it is not possible to add the red
    Can anybody help me?

  • LAYER 8 Netgate

    Add another Phase 2 entry with the new networks. This has to be done on both sides.

  • @derelict do not add new network for politics the other side VPN

  • LAYER 8 Netgate

    You are going to have to post exactly what you are trying to do then.

    What networks are on each side and what needs to talk with what.

  • @derelict said the other side to TUNNEL is network, need connect to devices to internal network to TUNNEL but only accept devices to configured into TUNNEL, noted the other side to TUNNEL only accept one network for politic to the company. do not add to other subnetwork

  • LAYER 8 Netgate


    What traffic selectors does the other side expect to see?

    Local <-> Remote ???

    What traffic selectors do you expect to see?

    Local <-> Remote ???

    Or both:

    Local <-> Remote
    Local <-> Remote

    If the former, it's easy. If the latter you can't do that without changes to the other side.

    pfSense will not NAT a larger network to a smaller pool of addresses. You can BINAT 1:1 or NAT to a single address. Natting to a single address would also require they change their tunnel to that /32.

  • @derelict
    Local <-> Remote
    Local <-> Remote
    expect traffic.
    Local <-> Remote
    is functionally
    Local<->TO REPRESENTATIVE IP <-> Remote

  • LAYER 8 Netgate

    Phase 2:
    Local Network: Network /24
    NAT: Network /24
    Remote Network: Network /24

    And you're done.

    Connections from, say, to will appear to them to come from

    Connections from them to will arrive on on your side.

    They should establish one traffic selector for traffic:

    Local <-> Remote

  • Oh!!! Genius... Thank you... Problem solved.

Log in to reply