Issue Port Forwarding across IPSec VPN tunnel

[pablo6469]

Hello,

Running into an issue Port Forwarding traffic to reach a server across an IPsec VPN. The web sever is 192.168.14.250 in site A but needs to be Port Forwarded to the WAN interface of site B.

Site A
pfSense
WAN 1.1.1.1
LAN 192.168.14.0/24 <IPSec VPN established to site B>
Web Server: 192.168.14.250 Ports 80, 443

Site B
pfSense
WAN 2.2.2.2
LAN 172.16.24.0/24

Any help would be greatly appreciated! I've been working on this for a few days without success.

Thank you!

[jimp]

Unfortunately you can't port forward across an IPsec tunnel without the destination side sending all traffic over IPsec (0.0.0.0/0 peer or default route with VTI). This is because IPsec doesn't respect reply-to currently. It isn't possible on enc0 and it doesn't function on VTI interfaces.

To do what you are after, you could use OpenVPN, or it may work if you proxy the traffic using haproxy, so that the connection is terminated on pfSense A and then A makes a fresh connection to B as a proxy, which could be nudged through IPsec.