topic Re: Can't access static NATTed server behind remote peer network in General Topics

Can't access static NATTed server behind remote peer network

Baasanjargal_Ts — Tue, 16 Mar 2021 01:51:06 GMT

Hello mates.

There is ipsec VPN tunnel between two checkpoints. Branch has two networks for staff and guests. Staff network 192.168.1.0/24 is on the VPN domain and guest network 192.168.2.0/24 is not added to the VPN domain. web server is behind headquarter firewall and static NATted. We can access that server from internet everywhere but just can't access from branch guest network. How to access that static NATted web server from guest network.?

Re: Can't access static NATTed server behind remote peer network

PhoneBoy — Tue, 16 Mar 2021 04:37:04 GMT

What log messages show on one or both ends when this happens?
Even if the guest network isn’t in the encryption domain, the NAT address for the guest network probably is in the encryption domain (implicitly).

My guess is the guest network also needs to be in the encryption domain to fix this.
You should be able to prevent the guest network from accessing other things using access rules.