Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login
    Introducing Netgate Nexus: Multi-Instance Management at Your Fingertips.

    How to get everyhing routed through an IPSEC, using NAT

    Scheduled Pinned Locked Moved IPsec
    7 Posts 2 Posters 344 Views 3 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F Offline
      fstx
      last edited by

      I think I have succeded in getting the IPSec tunnel up, but I can't figure out how to get everything that reaches the router into the tunnel.

      I have tried a Firewall/NAT/Outbound rule with Interface IPSec, source Network xx.xx.xx.xx/25, destination any, translation to yy.yy.yy.yy/32, which is in IPSEC selector of /30.

      When I do a traceroute, it seems the packets are routed out through the WAN interface onto the internet without going through IPsec.

      I don't need this router to general routing. I'd prefer that it doesnt do that.

      The router is a Netgate 1100 with 24.11-RELEASE

      N 1 Reply Last reply Reply Quote 0
      • N Offline
        netblues @fstx
        last edited by

        @fstx For starters 24.11 is very old and you should upgrade immediately.

        For your issue , you need policy routing rules on your lan interface sending traffic to the ipsec interface.(use advanced and specify the ipsec gw)

        F N 2 Replies Last reply Reply Quote 0
        • F Offline
          fstx @netblues
          last edited by

          @netblues Thank you for replying.

          I have upgraded to the stable version on the 26 branch, but I have not tried the current version.

          For the policy route, could you point me in the right direction? i have tried many variations of a Firewall/NAT/outbound rule, in hybrid mode, but i have not succeeded.

          Another thing is that I never see an IPSec interface in the target dropdown in other places.

          N 1 Reply Last reply Reply Quote 0
          • N Offline
            netblues @fstx
            last edited by

            @fstx said in How to get everyhing routed through an IPSEC, using NAT:

            I have upgraded to the stable version on the 26 branch, but I have not tried the current version.

            What does this mean??

            Policy routing has nothing to do with firewall nat..
            Nat happens only when traffic reaches the outbound interface.

            You have to steer traffic FIRST to the ipsec interface, and THEN nat rules will decide what gets natted.

            Why you need nat at the local ipsec interface? What are you trying to accomplish?

            @fstx said in How to get everyhing routed through an IPSEC, using NAT:

            Another thing is that I never see an IPSec interface in the target dropdown in other places.

            This also needs some explanation.

            F 1 Reply Last reply Reply Quote 0
            • F Offline
              fstx @netblues
              last edited by

              @netblues said in How to get everyhing routed through an IPSEC, using NAT:

              @fstx said in How to get everyhing routed through an IPSEC, using NAT:

              I have upgraded to the stable version on the 26 branch, but I have not tried the current version.

              What does this mean??

              That i have upgraded to more recent version

              Policy routing has nothing to do with firewall nat..
              Nat happens only when traffic reaches the outbound interface.

              Where do i set up a policy route? I’ve tried setting static routes. I don’t get a ipsec choice here in destination, so i tried using and address within the tunnels /30.

              Either (if the wan gw is enabled) it goes on other wan interface, or i get a destination unreachable.

              You have to steer traffic FIRST to the ipsec interface, and THEN nat rules will decide what gets natted.

              This is what I am trying to do.

              Why you need nat at the local ipsec interface? What are you trying to accomplish?

              The tunnel is to a different organisation. For the tunnel to come up I need to use their selector, zz.zz.zz.zz/30 -> 0.0.0.0.

              Then traffic needs to com from an address within that zz.zz.zz.zz/30. I need more than two local addresses, hence the need for NAT.

              I tried using VTI, but i could not get the nat rules to trigger.

              @fstx said in How to get everyhing routed through an IPSEC, using NAT:

              Another thing is that I never see an IPSec interface in the target dropdown in other places.

              This also needs some explanation.

              I think the user interface does not expose tunnel mode ipsec interfaces. Whenever i get an interface choices, it is either generic like LAN/WAN, or the spspecific ethernet interfaces (vmnet)

              Thank you for patience.

              1 Reply Last reply Reply Quote 0
              • N Offline
                netblues @netblues
                last edited by

                said in How to get everyhing routed through an IPSEC, using NAT:

                @fstx For starters 24.11 is very old and you should upgrade immediately.

                For your issue , you need policy routing rules on your lan interface sending traffic to the ipsec interface.(use advanced and specify the ipsec gw)

                Also assign an interface for ipsec.

                Try creating a diagram with everything, post some screenshots of what you've done and explain in detail what you need to accomplish.

                No one can imagine things.

                And have a look at the documentation too https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html

                F 1 Reply Last reply Reply Quote 0
                • F Offline
                  fstx @netblues
                  last edited by

                  First, I have succeded now i creating a workable configuration. It only routes traffic from two consecutive hosts on our LAN, but that works, at least for now.

                  I used the xx/30 selector, and BINAT using a /30 network sliced out of the /25.

                  I think the problem is that the BINAT in the P2 configuration part combines translation mode with IPSec source selector.

                  For the the other thing I tried, the Firewall/NAT/Outbound rule, I am unsure if I got the rule to trigger at all, or if I just failed to find a way to route it down the IPSec tunnel.

                  @netblues said in How to get everyhing routed through an IPSEC, using NAT:

                  said in How to get everyhing routed through an IPSEC, using NAT:

                  @fstx For starters 24.11 is very old and you should upgrade immediately.

                  For your issue , you need policy routing rules on your lan interface sending traffic to the ipsec interface.(use advanced and specify the ipsec gw)

                  You know, i don't see an ipsec interface anywhere in the GUI,

                  Also assign an interface for ipsec.

                  Been trying to do that.

                  Try creating a diagram with everything, post some screenshots of what you've done and explain in detail what you need to accomplish.

                  Something like this?

                  LAN: xx.xx.xx.128/25
                  |
                  Netgate: xx.xx.xx.130
                  |
                  IPSec tunnel: selector yy.yy.yy.yy/30 -> 0.0.0.0
                  |
                  WAN
                  |
                  Remote IPSec Gateway

                  No one can imagine things.

                  And have a look at the documentation too https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html

                  Thanks. This is a totally different section of the manual than I was looking for. No idea that the Multiple WAN interfaces was what I should be looking for.

                  Following the above, I run into the problem that gateway dropdown only lists default and WANGW.

                  Going back to System/Routing/Gateways, I find WANGW. I press add. The interface dropdown lists WAN, LAN and OPT. I tried using an address in the IPSec selector, but that did not work. Perhaps I did something worng here, and I should try again?

                  I think there is also a missing piece here, the NAT into the yy/30.

                  Thank you again for taking the time to help.

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2026 Rubicon Communications LLC (Netgate). All rights reserved.
                  Privacy Policy · Cookie Policy