Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 22 replies
  • Answers 2 answers
  • Subscribers 29 subscribers
  • Views 1317 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problem routing WAN traffic across IPSEC

Stuart James

I'm trying to route traffic from WAN across an IPSEC tunnel to a server

WAN -> Sophos1 -> IPSEC -> Sophos 2 -> Server

I've configured firewall rule and NAT rule, then added 'system ipsec_route add net 172.16.1.0/255.255.255.0 tunnelname IPSEC

I also added the WAN IP address to both sides of the IPSEC tunnel so that the Sophos knows where that IP sits.

Packet capture all looks perfectly correct on Sophos1

Problem is, when I do a packet capture on Sophos2 there is no traffic whatsoever. It's as if the traffic doesn't disappears in to the never never.

I've google around and read multiple forums and it all seems to be setup correctly.

What am I missing?



This thread was automatically locked due to age.
Parents
  • 0

    Can you give us some more details, please?

    Tunnel definition, private networks …

    Mit freundlichem Gruß, best regards from Germany,

    Philipp Rusch

    New Vision GmbH, Germany
    Sophos Silver-Partner

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to jprusch

    Not quite sure what you’re after. It’s a point to point IPSec tunnel using IKEv2. Tunnel has been running for 6+ years and all other traffic across it works fine, just not this NAT rule.

  • 0 in reply to LuCar Toni

    I’ve already got an ipsec route

    • I've configured firewall rule and NAT rule, then added 'system ipsec_route add net 172.16.1.0/255.255.255.0 tunnelname IPSEC

    Originating side is operating fine. But traffic doesn’t show up in packet capture on destination side

  • 0 in reply to Stuart James

    It looks completely fine then. Traffic is routed through IPsec. But no reply. 

    __________________________________________________________________________________________________________________

  • 0 in reply to jprusch

    I’m not going to post my IPs on a public forum. Happy to send to you in a private message if you think it will help.

    Entire destination subnet is in the IPSec config. I can ping and access all servers in Site 2 from Site 1 without any problem. It’s only the DNAT from WAN which isn’t working.

  • 0 in reply to Stuart James

    Likely the problem is caused by the other peer. As you are NAT only the destination, the original WAN connection stays there. The server could send the reply directly to the peers WAN and not back to the XFRM. 

    You could resolve this by doing a SNAT as well. Keep in Mind, you need to use a SNAT object, which is within your local network. So create a Host object within one of your Local Networks in Ipsec and use this in the same NAT rule. This should work. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Wild guess: could be the precedence of rules as well.

    Could you move the DNAT up to be processed first?

    Mit freundlichem Gruß, best regards from Germany,

    Philipp Rusch

    New Vision GmbH, Germany
    Sophos Silver-Partner

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to jprusch

    Likely not. You see, the NAT is hitting the packet capture. You have to read it from bottom to top. And it is natted and transfered to the XFRM. But nobody is replying. This could due multiple reasons: Firewall rule missing on Peer. Routing on Peer etc. 

    You will likely resolve all of those issues with a SNAT as well. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Yes I agree. SNAT was actually my first thought and is most logical, but if I put an SNAT in, it doesn't even route across the tunnel at all and just does straight out to the internet with no NAT or FW rules appled, which seems odd. I even tried a system SNAT. Screenshot below. If I remove the SNAT, packet capture shows it going across the tunnel, but never gets to the other end.

    I also tried putting the WAN IP address on both ends of the tunnel so that the Sophos knew to return traffic to the IPSec tunnel

    Before SNAT:

    After SNAT:

  • 0 in reply to LuCar Toni

    But if the firewall is missing on peer, or routing, it should at least appear in the packet capture. The packets would come in, the Sophos just wouldn't know what to do with them?

    On peer (Sophos 2) there's a VPN -> LAN allow all rule

  • 0 in reply to Stuart James

    Can you show us the NAT Rule? 
    And the Packet capture shows you, it is perfectly working from this firewall rule. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Without SNAT:

    With SNAT:

    I agree this side of the firewall looks fine (without the SNAT in place). Packet capture shows everything flowing correctly. Butthe Sophos on the other end never sees it. And other than a VLAN->LAN rule on the other end, not sure what else would be needed. The traffic should at least be showing in a packet capture at the other end.

Reply
  • 0 in reply to LuCar Toni

    Without SNAT:

    With SNAT:

    I agree this side of the firewall looks fine (without the SNAT in place). Packet capture shows everything flowing correctly. Butthe Sophos on the other end never sees it. And other than a VLAN->LAN rule on the other end, not sure what else would be needed. The traffic should at least be showing in a packet capture at the other end.

Children
  • 0 in reply to Stuart James

    You need to create a SNAT object, not using MASQ. 

    See my text: 

    You could resolve this by doing a SNAT as well. Keep in Mind, you need to use a SNAT object, which is within your local network. So create a Host object within one of your Local Networks in Ipsec and use this in the same NAT rule. This should work. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Perfect. That has indeed solved the issue, thanks. Just used a server on Site 1 for the SNAT.

    I'm confused though. It's a MASQ an SNAT that just presents the IP address of the firewall interface? Why wouldn't that work?

  • 0 in reply to Stuart James

    You have a Ipsec Policy based tunnel. There is no interface to MASQ. 

    __________________________________________________________________________________________________________________

Unfiltered HTML