Does FreeS/WAN support NAT traversal?
Vanilla FreeS/WAN does not, but thanks to Mathieu Lafon and Arkoon Network Security, there’s a patch to support this. • patch and documentation • Super FreeS/WAN incorporates this and other user-contributed patches. The NAT traversal patch has some issues with PSKs, so you may wish to authenticate with RSA keys, or X.509 (requires a patch which is also included in Super FreeS/WAN). Doing the latter also has advantages when dealing with large numbers of clients who may be behind NAT; instead of having to make an individual Roadwarrior connection for each virtual IP, you can use the “rightsubnetwithin” parameter to specify a range. See these rightsubnetwithin instructions.
