IPSec with subnet natting

[dietervh]

Hi all,

for one of our customers we should setup a new IPSec VPN tunnel.
Goal is simple, configuration looks a bit confusing.

Our subnet: 10.124.29.0/24
Remote subnet: 10.240.0.0/12

Till here, no problems.
But the customer site has a policy that they cannot route a 10.124.29.0/24. They have to use a /24 in the 10.150.0.0/16 set.
So we have been assigned 10.150.33.0/24.

PhaseII our side :
our subnet: 10.150.33.0/24
remote subnet: 10.240.0.0/12

PhaseII cust side :
our subnet: 10.240.0.0/12
remote subnet: 10.150.33.0/24

We should manage to NAT the whole subnet from 10.150.33.0/24 to 10.124.29.0/24.
Is this possible? How can this be done?
Use Virtual IP option? And do a 1:1 and outbound nat?

Attached : Visio PDF to clear out things.

Regards,
Dieter

[Metu69salemi]

Maybe this can be done with virtual ip's and manual outbound nat.

[dhatz]

Lack of NAT before IPsec is one of the known limitations of pfSense …

Check 2009 discussion here http://freebsd.1045724.n5.nabble.com/IPSec-nat-on-enc-device-td4023490.html

[Metu69salemi]

:P Ofcourse I forgot this.. then you must have two devices(one doing natting and another doing vpn) or think another solutions