Print Page - Switch to VTI filtering and NAT (instead of enc0)

Title: Switch to VTI filtering and NAT (instead of enc0)
Post by: hpsn on October 18, 2025, 01:08:25 AM

Hi All,

pfSense has the following configuration option that allows the filtering to be done on the VTI and that also support NAT on the VTI.

PFsense IPsec Filter Mode (https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/advanced.html)

Can someone please tell me what is the equivalent option in 25.7.x and the new VPN/IPsec implementation?

Many Thanks

Title: Re: Switch to VTI filtering and NAT (instead of enc0)
Post by: Monviech (Cedrik) on October 18, 2025, 09:02:31 AM

Opnsene supports filtering and NAT for policy and routing based IPsec tunnels at the same time. So you can have both :D

Its described here:

https://github.com/opnsense/docs/pull/769/files

The gist of it is to do all filtering and NATing directly on the IPsec interface and not the subinterfaces, without changing any tunables.

The only thing that needs to be done is enabling that firewall rules are totally skipped for VTI interfaces.

Title: Re: Switch to VTI filtering and NAT (instead of enc0)
Post by: hpsn on October 19, 2025, 02:41:50 AM

Thank you for providing that clarity! Will have another go at it.

OPNsense Forum

English Forums => Virtual private networks => Topic started by: hpsn on October 18, 2025, 01:08:25 AM