Hide-NAT over IPSEC VPN Tunnel

Options

nick_patchett

nick_patchett Posts: 12

Freshman Member

Zyxel Certified Network Administrator - Nebula

Zyxel Certified Sales Associate

First Comment

Fifth Anniversary

June 2019 edited April 2021 in Security

I've got a site-to-site IPSEC tunnel running between my USG40 and a Checkpoint firewall managed by an external supplier. They want me to use a feature called Hide-NAT - https://www.checkpoint.com/smb/help/utm1/8.2/7058.htm

So basically when any traffic from the internal LAN subnet destined for the server at the remote end of the VPN tunnel gets translated so at the far side it presents as the Public WAN IP address.

Is this possible? I've tried various SNAT and Destination NAT settings without much success.

0

All Replies

Alfonso Posts: 257 Master Member

June 2019

Hi @nick_patchett
Welcome to Zyxel Community :)
I am going to describe in theoretical mode, but from my point of view it should be possible.
The flow from Site A to Site B will be NATed on Site A, so the VPN should be configured from the NATed IP Site A to Network SIte B.
And flows from Site B to Site A will be NATed on Site B, so the VPN should be configured from the NATed IP Site B to Network SIte A.
I hope it helps.

Regards

0
CHS Posts: 181 Master Member

July 2019 edited July 2019

Hi nick_patchett
There is function named "Inbound/Outbound traffic NAT" in VPN phase 2 configuration.
It can hind real IP address in your VPN tunnel.

0
jasailafan Posts: 193 Master Member

July 2019

Hi @nick_patchett
Here is a similar scenario in FAQ.
Hope it helps.
https://businessforum.zyxel.com/discussion/509/how-can-the-inbound-destination-nat-be-used-to-hide-the-server-s-real-ip-via-a-vpn-tunnel

0

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）