Choose pfSense IPsec BINAT or overload translation by inbound reachability needs

Collapsing a local subnet into one translated address prevents direct inbound targeting of individual hosts.

Source facts

Netgate documents policy-based IPsec phase-2 translation. Equal-size actual and translated networks use bidirectional 1:1 mapping. Translating a subnet to one address creates overload/PAT behavior, where remote initiation to individual local hosts is unavailable. Different-sized subnet-to-subnet mappings are unsupported, and IPsec-tab rules refer to the actual Local Network after NAT processing.

Source: Netgate — NAT with IPsec Phase 2 Networks.

Applicability

This concerns tunnel-mode phase-2 NAT/BINAT.

DSE recommendation

DSE recommends asking whether the partner must initiate connections to specific local hosts before selecting a translation shape. Record actual local networks, remote-visible translated networks, and both peers’ selectors. Keep policy rules expressed against the address stage the firewall actually evaluates. Avoid promising bidirectional host access from a many-to-one mapping, and do not broaden local rules simply because a packet capture shows an unexpected pre-translation address. Ask the remote application owner whether any session must originate toward an individual local host before choosing overload. Put that answer beside the real and translated network table, then include the required initiation direction in acceptance instead of checking only a locally initiated ping.

Verification

With an approved peer, test locally initiated traffic and separately test remote initiation where the design requires it. Confirm the peer’s selector and observed translated source. Inspect policy matches using actual local addresses and document the intentionally unavailable inbound behavior when overload translation is selected.

Official reference

Netgate — NAT with IPsec Phase 2 Networks. Reviewed October 20, 2026.