Routing over IPsec VPN in PFsense to similar subnets

Networking & Firewalls
1

Good morning,

I have a site to site VPN between my home and office using an IPsec tunnel in PFsense. Both home and work are using PFsense firewalls. It has been working very well but I encountered an issue with two similar subnets. I have several VLANS set up in my home for testing. My primary VLAN used at home is a 192.168.30.0 network and this routs to my work network of 192.168.10.0. I also have a separate VLAN of 192.168.10.0 at home however; the devices are statically assigned from 192.168.10.2-192.168.10.9. The 10 network at work starts above this range. I fave a firewall rule in pfsense that allows al traffic between 192.168.30.0 and 192.168.10.0. The issue is with IPsec enabled I can no longer reach the devices on my home 10 network. When I ping the .10 devices from within PFsense from the .10 subnet, they can be reached. When I disable the IPsec the can also be reached from the .30 addresses. Is there a method to route from the 30 network to the locally statically assigned 10 network, while allowing all other traffic to continue to the work 10 network? I know the easy solution is to change the devices on the 10 network at home to a different VLAN, but I would like to see if this can be done via a rule or route table.

2

Ok so I don’t use IPsec or have different subnets with the same address range :slight_smile:

However, it strikes me me that you need to do some NAT jiggery-pokery on both sides to get the routing to work. For sure there must be a solution in the form of a fudge to get this to work but I doubt it can be sustained long term.

I’d look in the OpenVPN forums this is the type of scenario that must have come up before.

3

Perhaps something like assign 192.168.45.0 to your work and 192.168.54.0 to your home.

So entering 192.168.45.100 translates to 192.168.10.100 at your work

and

192.168.54.100 translates to 192.168.10.100 at your home.

Must be something like that, give it shot.

4

https://docs.netgate.com/pfsense/en/latest/recipes/openvpn-nat-subnets-conflict.html

here you go thought something about this was familiar

5

Thanks so much. That is a great help.