IPSec with NAT not working

[aniwon]

Hi,

we've migrated successfully from a SonicWall to a OPNsense box and almost everything works as expected.

There is just one problem: We have an IPSec tunnel to a customer which requires a /32-address on our site to be NATed to their /24-Network. We connect to a different local network on their site.

The required /32-address is configured as a virtual IP.

When I set this up - Phase 2 Local Network is our LAN Subnet, NAT address is the required /32-address - I can't connect to the other endpoint. Upon calling the customer and inspecting the log, he's telling me that we come in with the wrong IP and a /24-Subnet.

When I enter the required /32-address in the Phase 2 Local Network and disable NAT the IPSec tunnel connects successfully.

But I haven't found a way to route our LAN over the established tunnel.

Am I missing something?

[aniwon]

I've probably found the problem. There seems to be a general issue with IPsec and NAT.

https://github.com/opnsense/core/issues/440

So there are two dirty solutions for me then:
* Negotiate another VPN solution with the customer, or suggesting different settings the customer might be uncomfortable with (or we as well)
* Use the SonicWall again just for the IPsec tunnel