Knowledge Base  >   VPN  > 

Apply NAT inside IPsec VPN to match Remote Network's Firewall Policy

Vigor Router supports applying NAT to traffic in a LAN-to-LAN IPsec VPN, so that the remote network will only see traffic from a single IP address. This is necessary when the VPN server use one network for creating IPsec connection, but the firewall policy allow a different IP address to access their local network. Like the illustrated below.

On VPN Client site

1. Go to VPN and Remote Access >> LAN to LAN, click any index to create a profile.

2. In the profile,

Common settings

  1. Give a Profile Name
  2. Enable this profile
  3. Select the WAN interface
  4. Select Dial-Out for Call Direction
  5. (Optional) Tick Always On

Dial-Out setting(version 4.x.x)

  1. Select IPsec Tunnel
  2. Enter VPN server's WAN IP or domain name
  3. Input IKE Pre-Shard Key
  4. Enter the IP that VPN server requests at My WAN IP (In this example, the IP will be 172.16.2.129.)

Dial-Out setting(version 3.x.x)

  1. Select IPsec Tunnel
  2. Enter VPN server's WAN IP or domain name
  3. Input IKE Pre-Shard Key

TCP/IP Network Settings

  1. Enter the IP that VPN server requests at My WAN IP (In this example, the IP will be 172.16.2.129.)
  2. Enter VPN Server’s LAN network at Remote Network IP
  3. Select NAT
  4. Click OK

3. Go to VPN and Remote Access >> Connection Management and click Dial.

On VPN Server site

Here comes the difference with/without the client Local Network translating.

1. Without the VPN client Local Network translating: The Status will show the Virtual Network as VPN Client ’s LAN network. In this example, it is 192.168.1.1/24.

2. With the VPN client Local Network translating: The Status will show the Virtual Network as VPN Client ’s translated single IP. In this example, it is 172.16.2.129/32.

This article will show how to configure Vigor2960/3900 for meeting this purpose.


1. Go to VPN and Remote Access >> VPN Profiles >> IPsec page, click Add to create an IPsec LAN to LAN profile.

  1. Tick Enable
  2. Enter Local IP/ Subnet Mask
  3. Enter the IP of remote VPN server at Remote Host
  4. Enter Remote IP/ Subnet Mask

2. Go to Advanced tab, select Enable for Apply NAT Policy.Translated Local Network option will be visible after enabling Apply NAT Policy.

  1. Enter the IP that VPN server requests in Translated Local Network.
  2. In this example, it is a single IP 172.16.2.129, so we should select 255.255.255.255 for the subnet mask.

After the above configuration, Vigor2960 will translate the source IP to 172.16.2.129 while the LAN clients want to access remote VPN network 192.168.188.0/24.

 

Published On: 2020-09-30 

Was this helpful?   

book icon

Related Articles