How Nat between IPSEC VPN to LAN_1 and LAN1_to_IPSEC_VPN

RTC
RTC Posts: 4  Freshman Member
First Comment Fourth Anniversary
edited April 2021 in Security
Hello!
I have a USG110.
My porblem is: I have a virtual server connected to the zyxel usg110 by ipsec vpn.
My policy is: 192.168.0.0/16<>172.16.100.0/24
In this moment I have the virtual server with iP: 172.16.100.1
My USG100 have th ip in lan_1: 192.168.1.241
In the utm110 statistics show my adress in: 10.0.0.6

In  this moment in the remote server ( IP 172.16.100.1 ) when I try to ping the adress 192.168.1.241 (usg110) : the ping is OK
And i can connect to the USG110 page whithout problem

But if I try co connect to any other ip (ex: 192.168.1.230 ) , the ping fails! Only conect to USG110.

I need to make a NAT between: 192.168.0.0/16<>172.16.100.0/24 - in bidireccional mode whithout restrictions.

How I can do this??

Thanks


All Replies

  • Zyxel_Stanley
    Zyxel_Stanley Posts: 1,377  Zyxel Employee
    100 Answers 1000 Comments Friend Collector Seventh Anniversary

    Hi @RTC

    10.0.0.0/16-----------(192.168.0.0/16)USG110=====[VPN]=====VPN router(172.16.100.0/24)

    In your scenario should establishing the VPN tunnel by IP subnet 192.168.0.0/16 and 172.16.100.0/24.

    But real IP address on USG110 is 10.0.0.0/16.

    If you would like to access from 172.16.100.0 to real IP 10.0.0.016 subnet, you can add Destination NAT In VPN rule.

     

    Go to Configuration > VPN > IPSec > VPN Connection > edit “Yout VPN rule” > Show advance setting.

    There is a function named inbound/Outbound traffic NAT. You can add the destination NAT rule for mapping traffic to your real IP address

    e.g. Original IP: 192.168.1.10, Mapping: 10.0.0.10, Protocol: Any.

    Then accessing traffic from 172.16.100.0 to 192.168.1.10 will mapping to 10.0.0.10 directly.
  • RTC
    RTC Posts: 4  Freshman Member
    First Comment Fourth Anniversary
    Thanks for your help.
    I put: LAN1_SUBNET: 192.168.1.0/32
    gateway: 10.0.0.0/24
    I  create the object gateway in subnet range, because, my usg have dynamic ip in my router,. I think this is not a problem, because I have a DMZ rule in my gateway router.
    But if I only do this, in this way all pings fails, i can't ping any ip in lan 1.
    Thanks

  • RTC
    RTC Posts: 4  Freshman Member
    First Comment Fourth Anniversary
    hello.
    If I disable Destination nat and configure inboud/outbound, i'm able to connet all trafic from "servidor_subnet" to "lan1_subnet".
    But my problem is:
    I can't connect my lan1_subnet to "servidor_subnet".
    All pings fails in lan1
    Is you check my image: is this OK?
    Thnaks
  • Zyxel_Stanley
    Zyxel_Stanley Posts: 1,377  Zyxel Employee
    100 Answers 1000 Comments Friend Collector Seventh Anniversary
    Hi @RTC
    Your scenario seems different as I thought. Could you post your topology or send your configuration to me by private message?

Categories

Security Highlight


Read more

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）