[ATP/FLEX] How to route all traffic to IPSec peer gateway
When site to site VPN is configured between Nebula Firewall and the peer gateway, we can use policy routes to force the subnet of Nebula Firewall to access the Internet via the WAN connection of the peer gateway. The article instructs how to configure a policy route on each device to route all traffic to the peer gateway. In this example, we use Zyxel Firewall (on-premises mode) as the peer gateway.
Before Begin
You need to know how to set up site to site VPN in Nebula.
How to establish Site-to-Site IPsec VPN between Nebula and non-Nebula devices
Nebula Firewall
1. Configure > Firewall > Site-to-Site VPN
Set the Private subnet of the peer gateway. In this example, 192.168.100.1 is used for connectivity check.
2. Configure > Firewall > Routing
Click +Add to create a new routing.
Source: intranet, Destination: Any, Next-Hop: VPN NAME
Peer Gateway
1. In Local Policy, you have to fill in 0.0.0.0/0.
2.In order to access internet, you have to do Source NAT to translate 192.168.8.0/24 to the WAN interface.
Test Result
You will see source 192.168.8.33 have been NAT and routed to internet via the peer gateway.
Categories
- All Categories
- 347 Beta Program
- 2.1K Nebula
- 114 Nebula Ideas
- 77 Nebula Status and Incidents
- 5K Security
- 44 USG FLEX H Series
- 246 Security Ideas
- 1.2K Switch
- 65 Switch Ideas
- 901 WirelessLAN
- 33 WLAN Ideas
- 5.8K Consumer Product
- 204 Service & License
- 326 News and Release
- 71 Security Advisories
- 21 Education Center
- 5 [Campaign] Zyxel Network Detective
- 1.8K FAQ
- 831 Nebula FAQ
- 401 Security FAQ
- 219 Switch FAQ
- 190 WirelessLAN FAQ
- 45 Consumer Product FAQ
- 136 Service & License FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 71 About Community
- 61 Security Highlight