PFsense: Fake Subnet and IPsec Tunnel Mapping

PFsense: Fake Subnet IPsec Tunnel Mapping

In this article, we will discuss the concept of Fake Subnet IPsec Tunnel Mapping in PfSense. This technique is used to allow communication between two networks over an IPsec tunnel, even if the remote network's subnet is already in use locally.

Background

IPsec is a widely used protocol for secure communication between two networks over an insecure network, such as the internet. When setting up an IPsec tunnel, it is necessary to specify the local and remote networks that will be communicating over the tunnel. However, what if the remote network's subnet is already in use locally? This is where Fake Subnet IPsec Tunnel Mapping comes in.

Fake Subnet IPsec Tunnel Mapping

Fake Subnet IPsec Tunnel Mapping is a technique used in PfSense to allow communication between two networks over an IPsec tunnel, even if the remote network's subnet is already in use locally. This is done by creating a "fake" subnet on the local PfSense firewall, which is then used as the remote network in the IPsec tunnel configuration. This allows traffic to flow between the two networks as if they were directly connected, even though they are actually separated by the IPsec tunnel.

Configuring Fake Subnet IPsec Tunnel Mapping

To configure Fake Subnet IPsec Tunnel Mapping in PfSense, follow these steps:

1. Create a new network on the local PfSense firewall. This network will be used as the "fake" remote network in the IPsec tunnel configuration. For example, if the remote network is 172.x/24, you could create a new network on the local PfSense firewall called "FakeRemoteNetwork" with a subnet of 172.16.0.0/24.
2. Configure the IPsec tunnel. When configuring the IPsec tunnel, specify the "FakeRemoteNetwork" as the remote network. This will allow traffic to flow between the local network and the remote network over the IPsec tunnel, even though the remote network's subnet is already in use locally.

Example

Here is an example of how to configure Fake Subnet IPsec Tunnel Mapping in PfSense:

# Create a new network called "FakeRemoteNetwork"
ifconfig em1 create
ifconfig em1 inet 172.16.0.1 netmask 255.255.255.0

# Configure the IPsec tunnel
pfSense-Gold-Configurator ipsec phase1 add remote-gateway  local-subnet 10.0.0.0/16 remote-subnet 172.16.0.0/24

Fake Subnet IPsec Tunnel Mapping is a technique used in PfSense to allow communication between two networks over an IPsec tunnel, even if the remote network's subnet is already in use locally. This is done by creating a "fake" subnet on the local PfSense firewall, which is then used as the remote network in the IPsec tunnel configuration. This allows traffic to flow between the two networks as if they were directly connected, even though they are actually separated by the IPsec tunnel.

References

• PFsense documentation: https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/index.html
• IPsec RFC: https://tools.ietf.org/html/rfc4301

--endarticle--