Netgate SG-1000 microFirewall

Author Topic: Routing selective outbound NAT traffic through IPSEC  (Read 117 times)

0 Members and 1 Guest are viewing this topic.

Offline trueinnovation

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Routing selective outbound NAT traffic through IPSEC
« on: February 28, 2018, 07:14:39 pm »

We're expanding outside of our colo due to capacity constraints. We operate a number of transaction servers which communicate with customer systems. The customer systems are only open to our trusted IP range at the main colo facility.

What we need to do is tunnel traffic back from the overflow site to our main colo facility, then out via an outbound NAT rule to our customer sites. This should only apply to certain destinations, or even better for certain ports.

IPs altered to protect networks
PFSense at Main Colo
External IP range
Internal IP range:

PFSense at Secondary Colo
Exterrnal IP range:
Internal IP range:

We have a solid IPSec tunnel between and No problems with one-way traffic, everything is perfect.

Example transaction server 1 at overflow site: Internal IP:
Need to send all traffic to through main site IP  using outbound NAT on primary site.

Any suggestions on a good IPSEC /  NAT ruleset to get me started?


Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 10035
  • Karma: +1136/-312
    • View Profile
Re: Routing selective outbound NAT traffic through IPSEC
« Reply #1 on: March 04, 2018, 10:56:17 pm »
OpenVPN will be a lot more flexible for that.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!