X-Pool NAT — Overlapping Networks

Navigation: Scenarios → X-Pool Overlapping NAT

Connect two sites that use the same IP subnet (for example, both use 192.168.1.0/24) without routing conflicts. TOORCE uses an X-Pool (NAT address pool) to translate addresses:

Network design

Both sites use 192.168.1.0/24. Without NAT, routing cannot distinguish 192.168.1.10 (local) from 192.168.1.50 (remote). The firewall breaks the overlap using two non-overlapping translation pools.

Figure 1 — Overlapping subnet design with X-Pool SNAT and DNAT

Addressing summary

Traffic flows

LAN-initiated (SNAT):
  PC 192.168.1.10 → Remote 192.168.1.50
  Firewall rewrites source: 10.255.1.10 → 192.168.1.50
  Return traffic: 192.168.1.50 → 10.255.1.10 → de-NAT → 192.168.1.10

Remote-initiated (DNAT):
  Remote 192.168.1.50 → Virtual 10.255.2.20
  Firewall rewrites destination: → 192.168.1.20 (local server)
  Return traffic: 192.168.1.20 → SNAT pool as needed

Prerequisites

• IPSec VPN or private link between sites (tunnel interface up)
• Agreed X-Pool ranges with the remote administrator (must not overlap either site's real subnets)
• Address objects created before rules

Step 1 — Create address objects

Go to Aliases & Objects → Address and create:

Share the 10.255.1.0/24 and 10.255.2.0/24 pools with the remote site so their firewall can route replies correctly.

Step 2 — Configure interfaces

LAN interface (enp6s0)

VPN / remote interface (tun_ipsec or WAN)

Ensure the tunnel to the remote site is up and carries traffic for the remote 192.168.1.0/24.

See Network Interfaces and IPSec VPN.

Step 3 — Add static route to remote site

Even with overlapping subnets, the firewall needs to know that remote 192.168.1.0/24 is reached via the VPN — not the local LAN.

1. Go to Network Settings → Static Routs.
2. Click + Add New:

Local 192.168.1.0/24 stays on enp6s0. The static route sends remote traffic for the same CIDR out the tunnel. Policy-based routing or more specific host routes may be required in complex designs.

Step 4 — Inline rule: LAN → Remote with X-Pool SNAT

For traffic established from the local LAN toward the remote network:

1. Go to Rules & Policies → Inline Rules → + Add New.

General

Interfaces

Source / Destination

NAT/SDWAN tab

Remote hosts see your LAN PCs as 10.255.1.x, not 192.168.1.x.

Step 5 — Inline rule: Remote → Local with X-Pool DNAT

For traffic initiated from the remote network toward local services:

1. Click + Add New (place this rule above the SNAT rule if you use host-specific DNAT).

General

Interfaces

Source / Destination

NAT/SDWAN tab

Example mapping table

Tell remote users: "Connect to 10.255.2.20, not 192.168.1.20."

Step 6 — Install policy and verify

1. Click Install Policy.
2. Run checks:

Rule order recommendation

Design notes

• X-Pool ranges must be unique — do not use subnets that exist at either site or on the internet.
• Symmetric routing — remote site should route 10.255.1.0/24 and 10.255.2.0/24 back through the VPN tunnel.
• One-to-one vs many-to-one — use host-specific DNAT mappings for servers; use dynamic SNAT pool for many clients.
• DNS — applications that embed IP addresses may need FQDN or static host files on both sides.

Related topics

• NAT Gateway — basic internet SNAT
• Address Objects
• Inline Rules
• IPSec VPN
• Static Routes
• All Scenarios