Problem routing WAN traffic across IPSEC

Can you give us some more details, please?

Tunnel definition, private networks …

Not quite sure what you’re after. It’s a point to point IPSec tunnel using IKEv2. Tunnel has been running for 6+ years and all other traffic across it works fine, just not this NAT rule.

You have other servers that you already reach from WAN to Site2?

No. We have servers in Site 2 we reach from Site 1. Never tried to reach Site 2 from WAN before now.

Hi Stuart James

Please verify the configuration for site-to-site connection as per the below KBA and share the feedback with screenshots.

https://support.sophos.com/support/s/article/KB-000035717?language=en_US 

Thanks and Regards

I thought so. So we have to investigate what is missing for this kind of access.

That's why I asked for more infos about your specific environment and your setup.

I believe you, that your IPsec tunnel is working since years, but that's not the point.

 jprusch  there's not really much that could be wrong with the IPSec tunnel, but here are pictures

These Screenshots are senseless, lacking complete infos. How shall we check black squares?

ok last try: Is there an entry for the server by its IP or do you have the whole net included in your DNAT?

You likely will need a IPsec Route. 

docs.sophos.com/.../index.html

I’ve already got an ipsec route

• I've configured firewall rule and NAT rule, then added 'system ipsec_route add net 172.16.1.0/255.255.255.0 tunnelname IPSEC

Originating side is operating fine. But traffic doesn’t show up in packet capture on destination side

It looks completely fine then. Traffic is routed through IPsec. But no reply. 

It looks completely fine then. Traffic is routed through IPsec. But no reply.