Zywall 1100 NAT to a an ip address on the other side of an IPSEC VPN
I have a Zywall 1100 with an IPSEC VPN connection to another site.
The unit is connected to the internet on ge1 and on a local subnet 192.168.0.0/16 for the other interfaces
The remote site on the other side of the VPN has subnet 10.168.0.0/16. The VPN is configured with 192.168.0.0/16 as the local policy and 10.168.0.0/16 for the remote policy.
I want to set a NAT rule to forward traffic arriving from the internet on port 4433 to 10.168.20.161 (remote site) on port 443.
From a device in the local network, I can successfully hit https://<internet.facing.ip.address>:4433/ and access the service on 10.168.20.161:443. From the internet, https://<internet.facing.ip.address>:4433/ times out. It was difficult to set a policy control but I was eventually able to find one that doesn't log dropped packets (although it's more permissive than i was expecting it would need to be). However, even with the permissive policy control I cannot access the exposed service from the internet.
NAT rules that forward traffic to the local site (192.168.0.0/16) are working fine. Is there anything I'm missing to allow port forwarding to a service on a remote site?
Accepted Solution
-
Hi @emisaacson ,
Add policy routes on both sites.
Internet ←→ ZyWALL 1100 ←→ VPN ←→ Remote Site ←→ 10.168.20.161:443
On ZyWALL 1100,
1. Add a policy route for Internet to 10.168.20.161:443 over VPN tunnel to remote site.
Internet→(ge1)ZyWALL 1100→VPN→Remote Site→10.168.20.161
source: any, destination: 10.168.20.161, next-hop: VPN tunnel
2. And a policy route, for 10.168.20.161:433 to Internet be source NAT to ge1 IP of ZyWALL 1100.
Internet (ge1)←ZyWALL 1100←10.168.20.161
source: 10.168.20.161, destination: any, next-hop: ge1, SNAT: outgoing interface
On remote site,
1.Add a policy route, for 10.168.20.161:443 to Internet over VPN tunnel.
ZyWALL 1100 ← VPN ← Remote Site ←10.168.20.161:443
source: 10.168.20.161, source port: 443, destination: any, next-hop: VPN tunnel.
0
Master Member
All Replies
-
Hi @emisaacson ,
Add policy routes on both sites.
Internet ←→ ZyWALL 1100 ←→ VPN ←→ Remote Site ←→ 10.168.20.161:443
On ZyWALL 1100,
1. Add a policy route for Internet to 10.168.20.161:443 over VPN tunnel to remote site.
Internet→(ge1)ZyWALL 1100→VPN→Remote Site→10.168.20.161
source: any, destination: 10.168.20.161, next-hop: VPN tunnel
2. And a policy route, for 10.168.20.161:433 to Internet be source NAT to ge1 IP of ZyWALL 1100.
Internet (ge1)←ZyWALL 1100←10.168.20.161
source: 10.168.20.161, destination: any, next-hop: ge1, SNAT: outgoing interface
On remote site,
1.Add a policy route, for 10.168.20.161:443 to Internet over VPN tunnel.
ZyWALL 1100 ← VPN ← Remote Site ←10.168.20.161:443
source: 10.168.20.161, source port: 443, destination: any, next-hop: VPN tunnel.
0 -
0
Categories
- All Categories
- 397 Beta Program
- 2.1K Nebula
- 117 Nebula Ideas
- 81 Nebula Status and Incidents
- 5.1K Security
- 91 USG FLEX H Series
- 247 Security Ideas
- 1.3K Switch
- 69 Switch Ideas
- 918 WirelessLAN
- 35 WLAN Ideas
- 5.9K Consumer Product
- 211 Service & License
- 337 News and Release
- 71 Security Advisories
- 21 Education Center
- 5 [Campaign] Zyxel Network Detective
- 2K FAQ
- 920 Nebula FAQ
- 422 Security FAQ
- 237 Switch FAQ
- 208 WirelessLAN FAQ
- 47 Consumer Product FAQ
- 139 Service & License FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 72 About Community
- 62 Security Highlight
