[strongSwan] strongswan + source nat on freeBSD

Sebastian Jäschke jtkoerting at mac.com
Wed Sep 17 23:05:03 CEST 2014

Hello list!

I'm trying to achieve the following:

leftside is:

one machine with wan ip
all traffic thru the ipsec tunnel should have as source ip

rightside is:

one gateway with openswan installed with wan ip
behind the gate is a localnetwork


The left interface has a working route and the as alias set on the outside interface.

The tunneling is working, when I set the source IP on each function call like this:

ping -S is existing behind the rightside gateway.

I can use freeBSDs firewall 'pf' to do a nat on the source address, BUT then it's not recognized by strongswan/ipsec to begin a tunnel as it works when I explicitly set the source address e.g. with ping -S.

pfctl -s all shows it's NATing the source address (when I just use 'ping') , but no esp traffic is initiated, so no ipsec tunnel is used and the ping fails.

all icmp ( ->       0:0

I would be really, really pleased if someone points me to a solution for this (getting the right source address for all packets trying to access the inner tunnel network of rightside).
At the moment it looks like that in the freeBSD (10.0p8) Kernel the ipsec is checked BEFORE the nat rules are translated, so that the ipsec trap is never getting translated traffic. Is this my problem here with that setup?

Any help is welcome and many thanks in advance!


More information about the Users mailing list