4

Forgive me if this question is not for here. I have a situation where I need to connect Site-to-Site VPN between two offices but the company is small and a startup with a very tight budget. Thing is that the two offices have just a single static public IP. The routers in the offices do not have a VPN capability however it is possible for me to NAT/PAT individual devices out of the network, as well as to add additional static routes.

Is it possible for me to create a site to site tunnel behind NAT? I was thinking to deploy two PFsense VMs and use those to create the IPSec tunnel? Any other suggestion is welcomed, like a Linux box with Openswan/Strongswan etc.

So far my experience is mostly with Cisco, Palo Alto, Sonicwall and stuff and I have little experience with theese OpenVPN solutions so I was wandering if it is possible?

A short overview of how the network diagram would be: IPSec behind NAT Diagram

Improve this question
3
  • IPsec needs the routers to support NAT traversal (NAT-T). Any chance to get a public IP without NAT from the router?
    – Zac67 ♦
    Jun 13, 2017 at 20:08
  • At least one side should be with "white" IP or have NAT'ed ESP/ISAKMP ports.
    – Andrey Prokhorov
    Jun 14, 2017 at 5:59
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 14, 2017 at 22:08

1 Answer 1

Reset to default
2

As long as you can NAT the required protocol and ports (see below) on the routers, you can use any VPN solution that support NAT-Traversal (NAT-T) to establish an IPSEC tunnel (as commented by Zac67)

pfSense does support NAT-T, so you're good to go.

As you already find out, OpenVPN is commonly used in such case, because it is very NAT-friendly, and it is also supported by pfSense.

For IPSEC, you need to open / forward / PAT the following:

  • UDP 500
  • UDP 4500
  • ESP

Some access router have a specific feature to forward IPSEC packets. Others simply cannot forward ESP, in this case there's often a DMZ option (that will forward all incoming traffic to a given internal host) that could be used.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.