topic Re: Port forwarding through ipsec tunnel in General Topics

Port forwarding through ipsec tunnel

btolkawfp — Mon, 06 May 2024 22:37:17 GMT

Hello,

I have two Pa-440's. One 440 has a public static ip and the other is just dhcp as of right now. I do a site to site to site vpn working between them.

I setup an original port forward on the public static ip device to a local host and it worked great. Now, I moved that host to a subnet on the public dhcp firewall. I tried switching the port forward to the new ip at the remote location across the tunnel interface, but it never seems to work. Is this possible to do?

Bryan

Re: Port forwarding through ipsec tunnel

TomYoung — Mon, 06 May 2024 23:20:33 GMT

Hi @btolkawfp ,

NAT over VPN is definitely possible.

Do you have a route pointing to the subnet on the public dhcp firewall to the tunnel interface?
Did you change the destination zone of the NAT policy rule and security policy rule to reflect the change?
Do you see the failed traffic under Monitor > Logs > Traffic? Many times the log will reveal why it isn't working.

Thanks,

Tom

Re: Port forwarding through ipsec tunnel

btolkawfp — Tue, 07 May 2024 00:48:50 GMT

1.) The site to site between firewalls is working

2.) the destination zone of the port forward is untrust and untrust

3.) no failed logs ..just says incomplete.

the issue is getting the client using the public ip and then natting that request through a vpn tunnel and then back to the original firewall.

Re: Port forwarding through ipsec tunnel

TomYoung — Tue, 07 May 2024 01:18:50 GMT

Of course!

You will also need to do a source NAT to a prefix on the public static IP FW so that the return traffic is routed back. The easiest way to do it is put IP addresses on your tunnel interfaces (one on each side) and source NAT to the tunnel IP. The prefix on the tunnels can be a /30 or even a /31.

Thanks,

Tom

Re: Port forwarding through ipsec tunnel

btolkawfp — Tue, 07 May 2024 15:18:00 GMT

ok that makes more sense.. i am still having a hard time visualizing that source nat configuration. Here is port forward rule.

I added a tunnel interface of 10.10.10.9/30 to the public dhcp firewall and 10.10.10.10/30 to the static firewall

Thanks for your help.

Re: Port forwarding through ipsec tunnel

TomYoung — Tue, 07 May 2024 15:38:52 GMT

Hi @btolkawfp ,

You can modify the same rule to NAT the source IP to 10.10.10.10.

Thanks,

Tom

Re: Port forwarding through ipsec tunnel

btolkawfp — Tue, 07 May 2024 17:28:05 GMT

thanks got it work..