Configuring an IPsec VPN with Network Address Translation (NAT) on pfSense bridges the gap between secure site-to-site tunnels and overlapping or private internal subnets. When remote offices or cloud environments use identical local IP ranges, standard IPsec policies fail because routing tables can't distinguish between destination subnets. Implementing NAT directly within IPsec Phase 2 entries translates local addresses on the fly, allowing connections to establish cleanly without renumbering your entire existing network infrastructure.
Understanding how pfSense handles IPsec and NAT traversal requires looking past basic configuration Wizards. This guide walks through the exact mechanics of Phase 2 NAT mapping, firewall rule ordering, and troubleshooting common negotiation failures.
Core Architecture of IPsec with NAT on pfSense
Standard IPsec operates at the network layer, encrypting packets between specific local and remote subnets defined in your Phase 2 security associations. If your local network is 192.168.1.0/24 and the remote peer demands traffic from a specific 172.16.5.0/24 range, a direct policy match fails. pfSense solves this by introducing translation parameters directly into the Phase 2 configuration options.
The firewall separates these settings into two distinct blocks: For another perspective on this event, see the latest update from Reuters.
- Actual Local Network: The real subnet living behind your pfSense interface, such as your physical LAN.
- Translated Network: The virtual or masked subnet that the remote peer expects to see across the encrypted tunnel.
When packets leave your local hosts, pfSense intercepts them, applies the translation rules, encapsulates the modified packets into IPsec ESP or NAT-T wrappers, and transmits them to the remote gateway. The far side remains entirely unaware of your true internal layout, interacting only with the translated IP space.
Phase 2 Configuration and NAT Modes
Setting up translation requires navigating to your tunnel settings under the VPN menu in pfSense. You will choose between two primary translation modes depending on your connectivity requirements:
- BINAT (1:1 NAT): Used when the local and translated networks share an identical subnet mask structure. Every address in your real subnet maps directly to a corresponding address in the target subnet. This mode handles bidirectional traffic effectively because the mapping ratio is symmetrical.
- Overload / PAT Style NAT: Used when an entire local subnet must map down to a single translated IP address. This mode supports outbound-only connections. If remote hosts need to initiate connections inward through the tunnel, PAT configurations will drop the traffic.
To configure a basic 1:1 BINAT mapping in pfSense, follow these procedural steps:
- Log into your pfSense web interface and navigate to VPN > IPsec > Tunnels.
- Open your existing Phase 1 configuration or create a new one, ensuring IKEv2 is selected for better stability behind NAT boundaries.
- Locate the Phase 2 Entries section and click to add or edit a child security association.
- In the Local Network section, look at the upper sub-block. Set the type to Network and enter your actual local subnet (for example,
192.168.1.0/24). - Look at the lower sub-block within the Local Network settings. Set the type to Network and enter the translated subnet agreed upon with your peer (for example,
172.16.5.0/24). - Define your remote network normally in the remote selectors section, save the changes, and apply them.
Firewall Rules and Traffic Processing Order
A frequent pitfall during deployment involves firewall rules failing to pass traffic after the tunnel establishes. In pfSense, NAT transformations occur before packet filtering checks.
When configuring rules on the IPsec tab (Firewall > Rules > IPsec), remember that rules evaluate against your actual local subnet rather than the translated address space. If your hosts reside on 192.168.1.0/24, your firewall rules must permit traffic originating from 192.168.1.0/24, even though the remote peer sees the traffic arriving from the translated 172.16.5.0/24 range.
Ensure you also check your WAN firewall settings if your pfSense instance sits behind another upstream router or carrier NAT device. IPsec with NAT traversal relies heavily on UDP port 4500. Forwarding ports 500 (ISAKMP) and 4500 (NAT-T) to your pfSense WAN address prevents negotiation drops.
For further reading on core packet filtering mechanics, consult the Netgate Documentation. Additional architectural best practices can also be reviewed via the Opengear console management guides.
Common Configuration Mistakes
Even experienced administrators run into subtle traps when combining IPsec and NAT. Avoid these frequent errors to keep your tunnels stable:
- Subnet Size Mismatches: You cannot map networks of differing sizes through Phase 2 NAT (such as pairing a /24 subnet with a /27 subnet). Both sides must utilize matching CIDR block sizes for clean translation.
- Identifier Mismatches: When one or both endpoints sit behind NAT, aggressive mode or incorrect local/remote identifiers will cause Phase 1 to stall. Explicitly define IP addresses or Fully Qualified Domain Names (FQDNs) as identifiers rather than relying on default automatic settings.
- Lifetime Discrepancies: Ensure that Phase 1 and Phase 2 key lifetimes match precisely on both ends of the tunnel. Mismatched timers cause one firewall to attempt rekeying while the other considers the security association valid, resulting in sudden drops.
Frequently Asked Questions
Can I use IPsec NAT if both ends use the exact same private subnet?
Yes. This is the primary use case for Phase 2 BINAT. By translating your local 192.168.1.0/24 network to a non-conflicting remote range, communication succeeds without requiring physical renumbering.
Why does Phase 1 fail when my pfSense box is behind a home router?
If your pfSense WAN interface receives a private IP address, your upstream router must have UDP ports 500 and 4500 forwarded to pfSense. Additionally, ensure NAT-T (NAT Traversal) is enabled in your Phase 1 advanced settings.
Do I need to create manual outbound NAT rules for IPsec traffic?
No. Phase 2 NAT handles the translation internally within the IPsec subsystem. Standard Hybrid or Manual Outbound NAT rules under Firewall > NAT do not apply to traffic entering or leaving IPsec security associations.
How can I verify that traffic is actually hitting the translated network?
Navigate to Status > IPsec and inspect the active Security Associations. Check the traffic counters (Bytes In and Bytes Out) while running a targeted ping test from an internal host to verify that packets are traversing the tunnel.
