Bug #12023


Mobile IPsec NAT/BINAT entries missing from firewall rules

Added by Chris Linstruth 5 months ago. Updated 2 months ago.

Target version:
Start date:
Due date:
% Done:


Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
Affected Architecture:


Adding a NAT or BINAT to a mobile IPsec configuration does not work.

The nat rules are not added to the pf configuration.

This is true for 1:1 and Many:1

Actions #1

Updated by Jim Pingle 5 months ago

  • Target version set to 2.6.0
  • Plus Target Version set to 21.09

Noting here what I mentioned on Slack:

  • This is likely due to the fact that the "remote" network on mobile P2s is from the mobile settings and not defined inside the P2.
  • The logic building the 1:1 NAT rules may be skipping these either because the remote is empty, or because it's mobile, or both.
  • This could work for well-defined mobile address pools (maybe not per-user pools, though), but definitely isn't viable for RADIUS-assigned addresses since there is no way for the firewall to know what those are.
Actions #2

Updated by Chris Linstruth 5 months ago

Documenting a possible workaround:

If you have the following Mobile IPsec configuration:

Mobile Virtual Address Pool:
Mobile Phase 2 Local Network:
Mobile Phase 2 BINAT Network:

You can leave that configuration in IPsec (to make the traffic interesting to IPsec) and add the following 1:1 NAT entry in Firewall > NAT, 1:1

Interface: IPsec
External Subnet IP:
Internal network:
Destination network:

That will give you this in the rule set:

binat on enc0 inet from to ->

Actions #4

Updated by Jim Pingle 4 months ago

  • Status changed from New to Pull Request Review
Actions #5

Updated by Renato Botelho 4 months ago

  • Status changed from Pull Request Review to Feedback
  • Assignee set to Viktor Gurov

PR has been merged. Thanks!

Actions #6

Updated by Viktor Gurov 4 months ago

  • % Done changed from 0 to 100
Actions #7

Updated by Danilo Zrenjanin 3 months ago

  • Status changed from Feedback to Resolved

Tested on the:

2.6.0-DEVELOPMENT (amd64)
built on Mon Jul 26 14:27:42 EDT 2021

Works for both 1:1 and Many:1.

Ticket resolved.

Actions #8

Updated by Jim Pingle 2 months ago

  • Subject changed from Mobile IPsec NAT/BINAT rules not inserted into pf rule set to Mobile IPsec NAT/BINAT entries missing from firewall rules

Updating subject for release notes.


Also available in: Atom PDF