Ipsec with overlapping subnets on 2.0

[solvman]

Hi,

Has anyone done ipsec on overlapping networks? it is should be doable since 2.0 supports NAT on ipsec.

Best regards.

[jimp]

Actually it doesn't support NAT on ipsec in a usable way. You can't do it on a single router with overlapping subnets, and it gets ugly fast no matter how you try it, since you'd have to NAT in both directions.

[solvman]

What if you add another router to the network? It is totally impossible to re-ip either of the networks and i'm looking for a stable solution.

[jimp]

The problem is that you have to NAT both ways, or one side will believe it's local and the traffic will never get back into the tunnel.

Side A:
192.168.0.x

Side B:
192.168.0.x

Side A would have to pick another network to talk to B, so let's say:
192.168.10.x <-> 192.168.0.x (B)

That might work OK, but the source IP on the traffic going from A to 192.168.10.x is still going to be 192.168.0.x and the return traffic will think it's local. So you end up having to NAT the other direction as well:

192.168.20.x <-> 192.168.0.x (A)

So the IPsec tunnel would actually have to be between 192.168.10.x and 192.168.20.x. PCs at B that want to reach A would have to use the 192.168.20.x IPs, and would appear to be coming from 192.168.10.x IPs, and vice versa.

Adding a router on one side to pull off the NAT would work fine if there was only one end that had a conflict (like another existing VPN to the subnet in use at one site), but it doesn't help with a complete overlap.

[solvman]

this is pretty interesting article i found:

http://www.undeadly.org/cgi?action=article&sid=20090127205841

technically it is possible :) not on pfsense thought

[jimp]

Yeah, that is saying sort of what I said but in a lot more detail. :-)

Adding that to pfSense has been discussed, but it's too much work to make it into 2.0.