{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/choose-pfsense-ipsec-binat-or-overload-translation-by-inbound-reachability-needs/", "item": { "id": "https://update.dsesecurity.com/updates/choose-pfsense-ipsec-binat-or-overload-translation-by-inbound-reachability-needs/", "slug": "choose-pfsense-ipsec-binat-or-overload-translation-by-inbound-reachability-needs", "url": "https://update.dsesecurity.com/updates/choose-pfsense-ipsec-binat-or-overload-translation-by-inbound-reachability-needs/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/choose-pfsense-ipsec-binat-or-overload-translation-by-inbound-reachability-needs.md", "json": "https://update.dsesecurity.com/api/v1/posts/choose-pfsense-ipsec-binat-or-overload-translation-by-inbound-reachability-needs/" }, "title": "Choose pfSense IPsec BINAT or overload translation by inbound reachability needs", "summary": "Collapsing a local subnet into one translated address prevents direct inbound targeting of individual hosts.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:31+00:00", "modified_at": "2026-10-20T18:34:35+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 249, "potentially_affected": "This concerns tunnel-mode phase-2 NAT/BINAT.", "dse_recommendation": "DSE recommends asking whether the partner must initiate connections to specific local hosts before selecting a translation shape.", "primary_source": { "name": "Netgate — NAT with IPsec Phase 2 Networks", "url": "https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/phase-2-nat.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Collapsing a local subnet into one translated address prevents direct inbound targeting of individual hosts.

\n

Source facts

\n

Netgate documents policy-based IPsec phase-2 translation. Equal-size actual and translated networks use bidirectional 1:1 mapping. Translating a subnet to one address creates overload/PAT behavior, where remote initiation to individual local hosts is unavailable. Different-sized subnet-to-subnet mappings are unsupported, and IPsec-tab rules refer to the actual Local Network after NAT processing.

\n

Source: Netgate — NAT with IPsec Phase 2 Networks.

\n

Applicability

\n

This concerns tunnel-mode phase-2 NAT/BINAT.

\n

DSE recommendation

\n

DSE recommends asking whether the partner must initiate connections to specific local hosts before selecting a translation shape. Record actual local networks, remote-visible translated networks, and both peers’ selectors. Keep policy rules expressed against the address stage the firewall actually evaluates. Avoid promising bidirectional host access from a many-to-one mapping, and do not broaden local rules simply because a packet capture shows an unexpected pre-translation address. Ask the remote application owner whether any session must originate toward an individual local host before choosing overload. Put that answer beside the real and translated network table, then include the required initiation direction in acceptance instead of checking only a locally initiated ping.

\n

Verification

\n

With an approved peer, test locally initiated traffic and separately test remote initiation where the design requires it. Confirm the peer’s selector and observed translated source. Inspect policy matches using actual local addresses and document the intentionally unavailable inbound behavior when overload translation is selected.

\n

Official reference

\n

Netgate — NAT with IPsec Phase 2 Networks. Reviewed October 20, 2026.

", "content_text": "Collapsing a local subnet into one translated address prevents direct inbound targeting of individual hosts.\nSource facts\nNetgate documents policy-based IPsec phase-2 translation. Equal-size actual and translated networks use bidirectional 1:1 mapping. Translating a subnet to one address creates overload/PAT behavior, where remote initiation to individual local hosts is unavailable. Different-sized subnet-to-subnet mappings are unsupported, and IPsec-tab rules refer to the actual Local Network after NAT processing.\nSource: Netgate — NAT with IPsec Phase 2 Networks.\nApplicability\nThis concerns tunnel-mode phase-2 NAT/BINAT.\nDSE recommendation\nDSE recommends asking whether the partner must initiate connections to specific local hosts before selecting a translation shape. Record actual local networks, remote-visible translated networks, and both peers’ selectors. Keep policy rules expressed against the address stage the firewall actually evaluates. Avoid promising bidirectional host access from a many-to-one mapping, and do not broaden local rules simply because a packet capture shows an unexpected pre-translation address. Ask the remote application owner whether any session must originate toward an individual local host before choosing overload. Put that answer beside the real and translated network table, then include the required initiation direction in acceptance instead of checking only a locally initiated ping.\nVerification\nWith an approved peer, test locally initiated traffic and separately test remote initiation where the design requires it. Confirm the peer’s selector and observed translated source. Inspect policy matches using actual local addresses and document the intentionally unavailable inbound behavior when overload translation is selected.\nOfficial reference\nNetgate — NAT with IPsec Phase 2 Networks. Reviewed October 20, 2026.", "content_markdown": "Collapsing a local subnet into one translated address prevents direct inbound targeting of individual hosts.\n\n## Source facts\n\nNetgate documents policy-based IPsec phase-2 translation. Equal-size actual and translated networks use bidirectional 1:1 mapping. Translating a subnet to one address creates overload/PAT behavior, where remote initiation to individual local hosts is unavailable. Different-sized subnet-to-subnet mappings are unsupported, and IPsec-tab rules refer to the actual Local Network after NAT processing.\n\nSource: [Netgate — NAT with IPsec Phase 2 Networks](https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/phase-2-nat.html).\n\n## Applicability\n\nThis concerns tunnel-mode phase-2 NAT/BINAT.\n\n## DSE recommendation\n\nDSE recommends asking whether the partner must initiate connections to specific local hosts before selecting a translation shape. Record actual local networks, remote-visible translated networks, and both peers’ selectors. Keep policy rules expressed against the address stage the firewall actually evaluates. Avoid promising bidirectional host access from a many-to-one mapping, and do not broaden local rules simply because a packet capture shows an unexpected pre-translation address. Ask the remote application owner whether any session must originate toward an individual local host before choosing overload. Put that answer beside the real and translated network table, then include the required initiation direction in acceptance instead of checking only a locally initiated ping.\n\n## Verification\n\nWith an approved peer, test locally initiated traffic and separately test remote initiation where the design requires it. Confirm the peer’s selector and observed translated source. Inspect policy matches using actual local addresses and document the intentionally unavailable inbound behavior when overload translation is selected.\n\n## Official reference\n\n[Netgate — NAT with IPsec Phase 2 Networks](https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/phase-2-nat.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/choose-pfsense-ipsec-binat-or-overload-translation-by-inbound-reachability-needs/", "url": "https://update.dsesecurity.com/updates/choose-pfsense-ipsec-binat-or-overload-translation-by-inbound-reachability-needs/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/choose-pfsense-ipsec-binat-or-overload-translation-by-inbound-reachability-needs/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Choose pfSense IPsec BINAT or overload translation by inbound reachability needs", "item": "https://update.dsesecurity.com/updates/choose-pfsense-ipsec-binat-or-overload-translation-by-inbound-reachability-needs/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/choose-pfsense-ipsec-binat-or-overload-translation-by-inbound-reachability-needs/#article", "identifier": "https://update.dsesecurity.com/updates/choose-pfsense-ipsec-binat-or-overload-translation-by-inbound-reachability-needs/", "url": "https://update.dsesecurity.com/updates/choose-pfsense-ipsec-binat-or-overload-translation-by-inbound-reachability-needs/", "headline": "Choose pfSense IPsec BINAT or overload translation by inbound reachability needs", "description": "Collapsing a local subnet into one translated address prevents direct inbound targeting of individual hosts.", "abstract": "Collapsing a local subnet into one translated address prevents direct inbound targeting of individual hosts.", "articleBody": "Collapsing a local subnet into one translated address prevents direct inbound targeting of individual hosts.\nSource facts\nNetgate documents policy-based IPsec phase-2 translation. Equal-size actual and translated networks use bidirectional 1:1 mapping. Translating a subnet to one address creates overload/PAT behavior, where remote initiation to individual local hosts is unavailable. Different-sized subnet-to-subnet mappings are unsupported, and IPsec-tab rules refer to the actual Local Network after NAT processing.\nSource: Netgate — NAT with IPsec Phase 2 Networks.\nApplicability\nThis concerns tunnel-mode phase-2 NAT/BINAT.\nDSE recommendation\nDSE recommends asking whether the partner must initiate connections to specific local hosts before selecting a translation shape. Record actual local networks, remote-visible translated networks, and both peers’ selectors. Keep policy rules expressed against the address stage the firewall actually evaluates. Avoid promising bidirectional host access from a many-to-one mapping, and do not broaden local rules simply because a packet capture shows an unexpected pre-translation address. Ask the remote application owner whether any session must originate toward an individual local host before choosing overload. Put that answer beside the real and translated network table, then include the required initiation direction in acceptance instead of checking only a locally initiated ping.\nVerification\nWith an approved peer, test locally initiated traffic and separately test remote initiation where the design requires it. Confirm the peer’s selector and observed translated source. Inspect policy matches using actual local addresses and document the intentionally unavailable inbound behavior when overload translation is selected.\nOfficial reference\nNetgate — NAT with IPsec Phase 2 Networks. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:31+00:00", "dateModified": "2026-10-20T18:34:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/choose-pfsense-ipsec-binat-or-overload-translation-by-inbound-reachability-needs/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/choose-pfsense-ipsec-binat-or-overload-translation-by-inbound-reachability-needs/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose pfSense IPsec BINAT or overload translation by inbound reachability needs" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 249, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — NAT with IPsec Phase 2 Networks", "url": "https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/phase-2-nat.html" } } ] } }