topic Re: VPN Mesh over Starlink in General Topics

VPN Mesh over Starlink

mikefarmer — Tue, 17 Jun 2025 05:40:35 GMT

I have a VPN mesh between multiple Check Point devices. The last device which sits behind a Starlink internet route will not establish VPN connection even when aggressive mode is enabled. Debug is showing me that the IKE identifier is FFFFFF and not the name of the firewall.

Re: VPN Mesh over Starlink

PhoneBoy — Tue, 17 Jun 2025 15:53:02 GMT

If Starlink is somehow modifying/corrupting the IKE packets, not sure there's much we can do on our end.

Re: VPN Mesh over Starlink

oa_munich — Tue, 17 Jun 2025 17:58:27 GMT

Are you trying to connect via IPv4? If so, Starlink offers two IPv4 policies, "default" and "public":
- The default IPv4 configuration uses Carrier-Grade Network Address Translation (CGNAT) using private address space from the 100.64.0.0/10 prefix assigned to Starlink clients via DHCP - you are sharing one public IP address with multiple other clients, you can NAT to the outside world, but not back
- The Starlink public IPv4 policy is an optional configuration available to Local and Global Priority customers. A public IPv4 is reachable from any device on the Internet and is assigned to Starlink network clients using DHCP.

You have two options, become a priority customer and switch to the "public" policy OR connect via ipv6 - Starlink provides a /56 prefix.

https://www.starlink.com/support/article/13f0056c-6f6d-5a55-623c-fe94ad9947c5

Re: VPN Mesh over Starlink

PhoneBoy — Tue, 17 Jun 2025 18:37:16 GMT

Thanks for sharing.
Doesn't seem that Starlink is very VPN friendly.
That could be a function of CGNAT for IPv4, though.