We want to setup a IPsec connection between customer sites and our office so we can manage the hardware we place at customer sites (e.g. barriers). Its important that the VPN connection stays up all time.

We prefer to do this by placing a piece of IPsec supporting hardware (probably a router, already available in most cases) inside the customers network. The devices we need to manage for our customers will be placed behind this router. The router should setup a IPsec connection to our office.

Unfortunately we have not always control over the customers network so we are not always able to forward ports. Also not all customers are cooperative in terms of port forwarding.

Is it possible to configure IPsec so that it can operate without port forwarding at the customer side? (like OpenVPN does for example)

At our office we are using pfSense as IPsec server, at the customer site are in many cases already Edgerouter X devices available. In new installation we can also use other hardware even when i think that the solution is more in the configuration of IPsec when its even possible.

Network sketch: enter image description here

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 17, 2020 at 18:39

1 Answer 1


Yes, that is possible. You need to use NAT traversal mode (NAT-T), and the connection can only be initiated by the device behind NAT (ie. the connection must be made towards the node reachable from the public network). Note that NAT-T uses UDP port 4500 instead of 500 to connect.

  • I believe both 500 & 4500 will be used. Phase 1 negotiation is still over UDP 500. Aug 23, 2020 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.