[SOLVED] IPSEC NAT/BINAT

[minos]

Hi,

I'm just trying to setup an IPSEC VPN with NAT before IPSEC since I need to change the source address. As far as I understood is that I can use the NAT/BINAT setting in phase2 to get exactly what I want, but unfortunately its not working. So I hope that someone can help me to figure out whats wrong.

LAN: 192.168.1.0/24
NAT/BINAT 192.168.14.1/32
Remote: 10.x.x.12

My problem is that I got no SPD rule if the tunnel came up. If I change the setting to NAT/BINAT: 192.168.14.0/24 I got SPD rules but since I need to connect from an specific IP this wont work.

Furthermore I see no traffic going through the IPSEC tunnel at all and no errors anywhere.

Do I have to configure additional NAT rule or routes or anything else?

The phase1 and phase2 setting are correct since I can connect with racoon from another host with exactly the same settings.

Any help is appreciated.

regards
stefan

[fraenki]

Sounds like we have a very similar problem. I've opened a bug report:
https://github.com/opnsense/core/issues/369

[franco]

I heard someone will look at this next week.

[AdSchellevis]

Just fixed the issue, more information over here:
https://github.com/opnsense/core/issues/369

The changes will probably be part of the next release.

[franco]

Most definitely 15.7.17, thanks everyone!

[Kuragari]

Same problem. I have mobiles users VPN IPSec and NAT don't work.

Any special things to do in the configuration ? I have NAT in Hybrid mode, i saw the automatic NAT rules, I have a firewall rule on IPSec interface that allow all traffic, so I think all is ok.

If it is a bug, is that work with the least release 7.17 ?

[AdSchellevis]

Frank wrote some additional comments on this subject, here:

https://github.com/opnsense/core/issues/440

Outbound nat on real tunnels functions (defined in the NAT/BINAT option of the phase2 tunnel) should work, but you can't define custom nat rules for ipsec traffic at the moment. (the option is just not there)
I have tested the first with a point-to-point setup.

Probably we're going to add this feature at some point, but no date is set yet.

[Kuragari]

Hello, I am not an IPSec VPN expert so what i need to put in NAT/BINAT option to make working NAT for my VPN client.

Actually i have a functionnal VPN configuration for mobiles users, only NAT don't work. The option NAT/BINAT is set to None.

[AdSchellevis]

Hi,

If you want to outbound nat all your traffic from your tunnel to one ip, you can select under NAT/BINAT:
Type : Address
Address: Your (firewall) IP you want to nat to

That should do the trick.