Hide-NAT over IPSEC VPN Tunnel

nick_patchett · June 2019

I've got a site-to-site IPSEC tunnel running between my USG40 and a Checkpoint firewall managed by an external supplier. They want me to use a feature called Hide-NAT - https://www.checkpoint.com/smb/help/utm1/8.2/7058.htm

So basically when any traffic from the internal LAN subnet destined for the server at the remote end of the VPN tunnel gets translated so at the far side it presents as the Public WAN IP address.

Is this possible? I've tried various SNAT and Destination NAT settings without much success.

Alfonso · June 2019

Hi @nick_patchett

Welcome to Zyxel Community :)

I am going to describe in theoretical mode, but from my point of view it should be possible.

The flow from Site A to Site B will be NATed on Site A, so the VPN should be configured from the NATed IP Site A to Network SIte B.

And flows from Site B to Site A will be NATed on Site B, so the VPN should be configured from the NATed IP Site B to Network SIte A.

I hope it helps.

Regards

CHS · July 2019

Hi nick_patchett

There is function named "Inbound/Outbound traffic NAT" in VPN phase 2 configuration.

It can hind real IP address in your VPN tunnel.

jasailafan · July 2019

Hi @nick_patchett

Here is a similar scenario in FAQ.

Hope it helps.

https://businessforum.zyxel.com/discussion/509/how-can-the-inbound-destination-nat-be-used-to-hide-the-server-s-real-ip-via-a-vpn-tunnel

Hide-NAT over IPSEC VPN Tunnel

All Replies

Categories

Security Highlight

Security Help Center