topic static NAT in VPN tunel in General Topics

static NAT in VPN tunel

Tecki0815 — Fri, 19 Dec 2025 14:53:09 GMT

Hello,
I have a working VPN S2S tunnel between CheckPoint and SonicWall FW.
On CheckPoint site we need to NAT a 10.x.x.x address (static NAT) so from the SonicWall site a VPN connection can be opened to our internal host.
When I adjust the host object adding a static NAT to it, I can see in the logs, that the host IP is not natted and dropped by the firewall.

do you have any hint, how the NAT within out VPN tunnel can be achieved ?

OurHost(10.10.10.10, static NAT 122.122.122.10)

working VPN (with no NAT rules):

PartnerHost 100.100.100.1 -> OurHost(ORIG IP 10.10.10.10)

Needed connection (using NAT):

PartnerHost 100.100.100.1 -> OurHost(NAT 122.122.122.10)

Do you have any hint how to configure this ?
As we have many working VPN connections, a global setting change may impact other VPNs.

The SonicWall may not even open a VPN in case there is a little issue with the NAT.

Thank you

Re: static NAT in VPN tunel

CaseyB — Fri, 19 Dec 2025 16:49:03 GMT

Since you are configuring the static NAT on the host object, check this option within the VPN community, it should be unchecked for this scenario.

Re: static NAT in VPN tunel

the_rock — Fri, 19 Dec 2025 17:06:04 GMT

Pretty much you configure manual static nat rue and as @CaseyB said, make sure that option is disabled inside community object.

Re: static NAT in VPN tunel

ThomasH — Tue, 23 Dec 2025 13:53:01 GMT

Additional to the mentioned setting, please also check that the 122.122.122.10 is within your VPN Domain (formerly called Encryption Domain) and that the ruleset also allows the connection to the NAT IP.

Re: static NAT in VPN tunel

the_rock — Thu, 25 Dec 2025 05:13:06 GMT

Hey mate,

Were you able to sort this out?