How to route Internet traffic through the Site-to-Site IPSec VPN?

Joseph,

did you have a look at this thread?

https://community.sophos.com/products/xg-firewall/f/vpn/92867/ipsec-site-to-site-vpn-connects-but-no-traffic-passes

Regards

Edit: I'm not quite sure how to add internet routes... system ipsec_route add net 0.0.0.0/0.0.0.0 tunnelname "VpnName" should be the right command, but I still can't access any outside IP.

Alright, thanks! I'll try to add Internet routes using the routing commands mentioned in that post.

Joseph,

can you explain better what you are trying to achieve?

Upload a network diagram.

Regards

I'm trying to route all internet traffic through the IPSec VPN to the XG Firewall of the main site (in Azure) so it can be filtered through the firewall of the Azure XG Firewall.

Attached is a network diagram.

Joseph,

I am not sure you can achieve that with no issue. XG has its own routing table and with precedences. Try to go to advanced shell and print out the routing table using:

route -n

From there check if you see the routing you have added using the console command and you can try to remove its default route 0.0.0.0/0.0.0 using linux commands and see if the IPSec route works.

Pay attention, because you can lose connection to your XG. Do a backup before doing this.

Regards

These are the only routes, there is no default route for 0.0.0.0

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.255.0.0 0.0.0.0 255.255.255.0 U 0 0 0 GuestAP
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 LANBridge
192.168.137.0 0.0.0.0 255.255.255.0 U 0 0 0 Port2

So even the IPSec Site to Site route is missing?

Is the IPsec working? What did you put inside the Remote LAN network inside the IPSec tunnel?

Sorry, I meant to say that XG does not have a default 0.0.0.0 route. I wasn't able to reply because adding the 0.0.0.0 route for the IPSec stops my internet from working. Here are the routes, with the new route added:

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 ipsec0
10.255.0.0 0.0.0.0 255.255.255.0 U 0 0 0 GuestAP
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 LANBridge
192.168.137.0 0.0.0.0 255.255.255.0 U 0 0 0 Port2

Hi Joseph,

I would use a RED tunnel.  It will simplify the setup since the RED is an interface in the firewall.  Creating a gateway is then trivial at that point (just like any other interface).

Thanks,

John

Must the RED interface on the master site be exposed directly without NAT? Because I'm hosting the master site on Azure, and Azure places VMs behind a firewall-like NAT (which I've configured to allow all connections), but the IP assigned to the WAN interface is something like 10.1.0.5. Additionally, does the RED interface completely take up the interface? Because I need to use other ports like for the SSL VPN for client devices.

Joseph

Hi Joseph,

With Azure, RED (in my opinion) is easier to deploy.  I use RED tunnels with no issues for our on-prem firewalls into Azure.

The interface is not a physical interface, but the firewall treats it just like any other interface.  So when you configure the RED options, you will see a new interface called reds<number> created on the firewall.

Since it's an interface/network, you will need to create or terminate it into the proper zone, create proper routes, firewall rules, etc.

Feel free to DM me and I can help walk you through a typical setup.

Thanks,

John

Hi Joseph,

With Azure, RED (in my opinion) is easier to deploy.  I use RED tunnels with no issues for our on-prem firewalls into Azure.

The interface is not a physical interface, but the firewall treats it just like any other interface.  So when you configure the RED options, you will see a new interface called reds<number> created on the firewall.

Since it's an interface/network, you will need to create or terminate it into the proper zone, create proper routes, firewall rules, etc.

Feel free to DM me and I can help walk you through a typical setup.

Thanks,

John

Thanks, I'll give setup a try and send you a message if I need any help :)

Thanks, Joseph