topic Re: How to route internet traffic through a tunnel interface in General Topics

How to route internet traffic through a tunnel interface

helge — Fri, 03 Feb 2012 11:36:13 GMT

What's the best way to route all internet traffic (except IPSec VPN tunnels) through a IPSec VPN tunnel interface?

We want to have a single point where all internet traffic passes through and uses the same policies for web and applications.

Re: How to route internet traffic through a tunnel interface

rmonvon — Fri, 03 Feb 2012 15:03:42 GMT

Hi...You can try defining a default route and set the next-hop to be the tunnel interface. Thanks.

Re: How to route internet traffic through a tunnel interface

helge — Mon, 06 Feb 2012 07:32:00 GMT

Hi,

I've already tried to set the default route (0.0.0.0) to the tunnel interface, and set the next hop to the gateway for the tunnel interface. But it seems like this configuration is not working with the logic/processing flowchart of the firewall.

On the remote PA firewall I've added a rule from the VPN zone to Untrust and NAT rule.

Another possible solution is to add static routes to the remote IP of the firewall with a next hop to the gateway, and then route default gateway through the tunnel. I haven't had chance to try this out as this is in a production environment. Anyone have a lab setup they could test this? Or even better, anyone else actually routing default gateway through a tunnel interface?

Re: How to route internet traffic through a tunnel interface

licenselu — Mon, 06 Feb 2012 07:37:28 GMT

Hello,

In your previous mail, you said :

Another possible solution is to add static routes to the remote IP of the firewall with a next hop to the gateway, and then route default gateway through the tunnel.

Basically, that's the only way to solve your issue !

With this config, it should work...

Regards,

Hedi

Re: How to route internet traffic through a tunnel interface

rmonvon — Mon, 06 Feb 2012 15:59:12 GMT

Hi...You configured 2 things here: 'set the default route (0.0.0.0) to the tunnel interface, and set the next hop to the gateway for the tunnel interface.' I would recommend testing only one: set the default route 0.0.0.0/0 to the tunnel interface and leave the next hop at <none>. Thanks.

Re: How to route internet traffic through a tunnel interface

hsnetworks01 — Sun, 30 Sep 2012 17:45:54 GMT

Hi. Not work for PPoE with static address (other in default). Any idea? Thanks.