Port forward over IPsec, remote site sending all traffic over VPN
-
We have a device in a remote site with a Netgate appliance we'd like to port forward to from the external IP of our central site firewall (a Checkpoint device). So:
Internet > Checkpoint FW > IPsec VPN > pfSense FW > Device
NAT is configured on the Checkpoint to send to the remote site IP. I can get to the device internally at the main site, but not from externally.
The remote site is forwarding all traffic (0.0.0.0/0) over the IPsec VPN, which is what we want. Right now this isn't working but I can't figure out why. All other mentions on this forum indicate that the only way to get this to work is to forward all traffic from the remote site, which most people don't want to do, but we're already doing that so I don't see why this couldn't work...
Any ideas?
-
No reply-to on the pfSense side because it is not supported on IPsec.
Not a lot of options there.
If the Checkpoint side can NAT the source address of the connections to something interesting to IPsec on the pfSense side that should work.
You'll probably have to show your work on the "forwarding all traffic over the IPsec VPN" because if that was the case it would be working.
Give more details like the destination address of teh target server, a good network diagram, etc.
-
My understanding was that reply-to wouldn't be necessary if all traffic was being sent over the VPN. There are two P2 proposals configured on the pfSense side for two local subnets, 172.16.25.0/24 and 10.2.20.0/24. Remote subnets configured for both are 0.0.0.0/0. The device I want to port forward to is 10.2.20.1. Tomorrow when I'm in the office I can snag some screenshots if desired.
On the Checkpoint side I do have a NAT rule created to translate the destination address (for the port forward) but nothing to translate the source address. Can you elaborate on what "interesting to IPsec on the pfSense side" means? In this case I feel like it shouldn't matter what the source address is because literally all traffic should be going out the IPsec VPN.
-
If it is really set like you say it should work without reply-to.
Going to probably have to packet capture hop-by-hop to see where the connection request is going then where the reply traffic is going. The first place I would capture is at the 10.2.20.0/24 interface.
