topic Re: Route Incoming external traffic over VPN in Firewall and Security Management

Route Incoming external traffic over VPN

Shahar_Grober — Wed, 07 Oct 2020 10:39:05 GMT

Hi,

I am struggling with routing external incoming traffic that is coming from the External Interface via a VPN tunnel?

The traffic flow should be:

External IP --> External GW published IP --> Static NAT to internal dst IP --> VPN Tunnel --> dst

To explain shortly - incoming traffic from external IP is hitting the GW published IP (via Proxy ARP) and NATed to an internal address which should be routed via the VPN.

I added the External IP address to the VPN domain but still the Traffic is not routed over the VPN but going out back via the external interface

There is a static NAT to translate the external dst IP address to the Internal dst IP address which should go to the VPN

External IP --> External GW IP

External IP --> Internal dst IP

however the traffic goes back via the External Interface

Any SK or a idea how to tackle this issue?

Re: Route Incoming external traffic over VPN

PhoneBoy — Fri, 09 Oct 2020 23:19:54 GMT

The decision to encrypt is based on the source IP being in the encryption domain, which I'm guessing is not the case here.
Perhaps with a route-based VPN and a null encryption domain, you could make this work.

Re: Route Incoming external traffic over VPN

Shahar_Grober — Sat, 10 Oct 2020 10:28:41 GMT

Hi PB,

The traffic is coming from external interface and although I added the External Incoming IP to the VPN domain it is still not routed via the tunnel. I guess the VPN topology doesn't include external address for a reason (or a bug in the VPN topology calculation). I tried to find any SK about routing external traffic via internal VPN but couldn't find anything useful

I was trying to avoid route-based VPN but I guess this is the only way so I will have a look at it

Thanks for your answer

Re: Route Incoming external traffic over VPN

PhoneBoy — Sat, 10 Oct 2020 15:16:44 GMT

If it’s from a specific IP in the encryption domain,
it sounds like a bug.
You might want to engage with the TAC.

Re: Route Incoming external traffic over VPN

Wille010 — Wed, 25 Aug 2021 09:54:58 GMT

Hello Shahar,

Did you solved this by using route-based VPN or did you still used domain-based for this?

Tia

Lesley