IPsec: The same LAN + VLAN network

patrick.pesegodinski

Hello everyone, look at this scenario, where I can't find a solution:

Pfsense Matrix:

LAN: 10.1.1.0/24
VLAN 100: 172.36.0.0/24

Pfsense Branch:

LAN: 10.1.1.0/24

I configured an IPsec tunnel to connect the VLAN with the branch, so far so good, communication between the two points working without problem.

But with the tunnel connected, because the IP range of both LANs is the same, the head office LAN ends up no longer communicating with the VLAN.

viragomann

@patrick-pesegodinski
Configure BINAT in the IPSsec phase 2 to avoid overlapping networks conflicts.

patrick.pesegodinski

@viragomann I configure the VLAN interface in this option?

viragomann

@patrick-pesegodinski
No, you have to NAT the branch LAN to avoid address conflicts.

In the IPSec phase 2 for the local network at NAT/BINAT translation select Network and enter e.g. 10.1.11.0/24.
Then change the remote network in the matrix phase 2 to 10.1.11.0/24.
Thenceforward you have to use e.g. 10.1.11.25 inside the Matrix local network to access 10.1.1.25 at the branch LAN.

patrick.pesegodinski

@viragomann Thanks for helping me.

Your tip worked for me.