topic Re: Route a specific internet site through remote gateway in General Topics

Route a specific internet site through remote gateway

Aaron_Lee — Mon, 03 Sep 2018 03:33:16 GMT

We use full mesh Check Point VPN, each site use a gateway for the Internet access ( local breakout), however there's a request to route a specific internet site through another VPN site which should deliver the traffic from that remote gateway and not the local breakout, anyone has any idea how this request can be achieved in Check Point VPN? Thanks in advance.

Re: Route a specific internet site through remote gateway

Gomboragchaa — Mon, 03 Sep 2018 06:25:27 GMT

Hi,

I am not sure, But I think you cannot route to specific website through over another VPN.

You have only 2 options. Internet traffic goes over each gateway or All traffic through over central vpn firewall.

Re: Route a specific internet site through remote gateway

_Val_ — Mon, 03 Sep 2018 07:13:19 GMT

The scenario is not exactly clear. Could you put a short diagram together on what you are trying to do, please?

Re: Route a specific internet site through remote gateway

Claudio_Bolcato — Mon, 03 Sep 2018 15:18:18 GMT

the only thing comes to my mind is VTI and route based VPN, depending on your mesh community size.

Re: Route a specific internet site through remote gateway

Timothy_Hall — Mon, 03 Sep 2018 23:09:17 GMT

Perhaps configuring the file vpn_route.conf can help here? Have seen it used before many times but admittedly not for traffic going to an Internet site...

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

Re: Route a specific internet site through remote gateway

Vladimir — Tue, 04 Sep 2018 13:04:40 GMT

Configure CP in the specific site as a non-transparent proxy mode (you can add an interface to anchor proxy functionality to it) and set up NAT to it in your branch gateway.

Create PAC file for the branch to define NATed proxy IP for the URL in question and exempt the rest of the web traffic using "Direct".

Re: Route a specific internet site through remote gateway

Aaron_Lee — Mon, 03 Dec 2018 05:24:05 GMT

Hi Timothy,

Thanks for your reply and we have tried this way, however when test the traffic we see the traffic sent to remote gateway through the VPN tunnel but after that the traffic was dropped on the remote gateway with this log:

encryption failure : according to the policy the package should not have been decrypted.

If the traffic is not an internet site, then it is ok.

Re: Route a specific internet site through remote gateway

Tomas_Jurak — Mon, 28 Jan 2019 11:09:10 GMT

Hmm, seemed like a good idea to me, but then I found an article stating that it can not work: HTTP and HTTPS traffic is dropped and/or latency is experienced when HTTP / HTTPS traffic goes through a VPN tunnel . My customer uses R77.30. Anyway, I will ask them to run a small virtual machine with squid or some other proxy, it should work.

Thanks!

Re: Route a specific internet site through remote gateway

Vladimir — Mon, 28 Jan 2019 15:23:20 GMT

Just looked at the sk you are referencing. Perhaps it is applicable to R80+ as well, but these versions are not listed in the "Applies to" section.

You may want to run it by CP to figure out if it is still the case or if the product was modified to support it.