Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NAT-Reflection on IPSec endpoint

    Scheduled Pinned Locked Moved NAT
    1 Posts 1 Posters 1.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      trendchiller
      last edited by

      Hi !

      We have a remote subnet that is connected via IPSec to our mail subnet.
      On the remote side all traffic is routed over our main subnet and it's gateway by using IPSec phase2 with remote / local subnet 0.0.0.0/0.
      On our main gateway we set up outbound NAT for the remote subnet.
      So far it works without problems…

      On out main gateway we use WAN-CARP for redundancy.
      On the WAN-CARP we use inbound NAT for a HTTPS server in our LAN.
      From out main subnet this HTTPS server is reachable via it's original IP or with the external WAN-CARP (thanks to NAT-Reflection)

      From the remote subnet this HTTPS server is NOT reachable with the external WAN-CARP (but with it's original IP in the main subnet)
      So the question is why NAT-Reflection does not work in this case.

      When someone from the remote location tries to reach the remote server over it’s external WAN-CARP IP
      all my packet captures show packets from the remote subnet to our external WAN-CARP but no response back.

      Does anyone have a thought / idea ?

      regards,
      martin

      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.