[SOLVED] inbound traffic with NAT/BINAT translation via IPsec
-
Hi,
we are using pfsense 2.4.4
our LAN subnet is 192.168.1.0/24
we have setup an IPsec IKEv1 Tunnel to a partner which need to use NAT/BINAT translation using 192.168.101.2 as the NAT Address.
Now the partner wants to access a Service within our LAN on the IP 192.168.1.26 over this IPsec Tunnel.
How do I realize such a traffic flow?
Do I just need to setup a Port Forward NAT on the IPsec interface giving the NAT IP 192.168.101.2 as destination address and the local LAN IP 192.168.1.26 as the Redirect IP?
And then for sure setup firewall rules on the IPsec interface with the desired LAN IP as the destination?We have already set up a few IPsec tunnels with NAT/BINAT translation but always accessing services on the remote side an not accessing services on my LAN side.
I do not find something about this in the docs.
Thank you and best regards!
-
Have you tried to do what you have described? It sounds like the correct thing to do, but I do not think I have ever seen it done - or don't remember. Note that you can only do one such forward on each port. Just like inbound connections to a single WAN address.
Also, you cannot forward from arbitrary source addresses over IPsec because you do not get reply-to. The source address (the destination for reply traffic) has to be something interesting to IPsec - as in a remote network in the Phase 2 entry.
-
I tried it exactly as I guessed (and derelict too) and it worked.
Thank you for your help!
