How to configure full NAT to server over IPSec Site-to-Site VPN

Hi Tauriq Ridley: Thank you for connecting Sophos community team. Over a firewall that contains external IP 1.1.1.1, you may configure DNAT over the VPN (as your destination server is over VPN for this firewall).

Reference steps:

https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/learningContents/CreatingDNATRuleWebServer.html

https://support.sophos.com/support/s/article/KB-000035604?language=en_US

Once DNAT configuration is done, you may add a manual IPSec route and system-generated NAT via the below command.

console> system ipsec_route add host 172.16.4.5 tunnelname <Name of tunnel>

Execute the following command to NAT Sophos Firewall generated traffic:

console> set advanced-firewall sys-traffic-nat add destination 172.16.4.5 snatip <Network1 FW LAN- IP>

Please refer to below scenario ( Syslog over VPN) to get more information on why IPSec route and SNAT is required.

https://support.sophos.com/support/s/article/KB-000035820?language=en_US

In your case, in place of Syslog it is your webserver which you have published on WAN IP 1.1.1.1 of FW-1.

Hi Vishal. Thanks so much for the help.

I will need to read through the info properly once home.

However i have tried what you suggested quickly but with no luck. I have inclueded some pictures of current dirty setup on Network#1 firewall.

I can even see that all traffic to 172.16.4.5 is routed through ipsec0 now using firewall rull 1 and NAT rule 1.

But i am obviously still doing something wrong.

Firewall Rule:

NAT Rule:

Hi Tauriq Ridley,

Thank you for reaching out to the Community! 

Are you trying to access the webserver from network#2 via IPsec site to site tunnel or using the DNAT rule? 

Thanks,

Hi no.

I am trying to access a webserver on Network#2 from Network#1 External Ip: 1.1.1.1

So basically:

External internet - Network#1 - IPsec Tunnel - Network#2 - Webserver

Thanks

also i just noticed the below:

ip route get .... seems to return an apipa address.

however system ipsec_route . . . . 

Delete the SNAT Rule on Cli. Instead do the same in the NAT rule on Webadmin. Use a custom source host. 

Hi Tauriq Ridley,

In that case, besides what Vishal_R suggested, you could also add the public IP address of the server in the remote network on the peer firewall, it’ll force the traffic to the public IP address route through the IPsec tunnel. 

Thanks,

Thanks Harsh Patel.

Also didnt work unless im doing it wrong.

I am starting to get the feeling that there is something very wrong with my firewall setup in general. (Configs that clash maybe)

Ill try again tomorrow and see what happens.

Vishal_R LuCar Toni & 

Thank you so much for your help.

I managed to get it working today by cleaning up some of the existing firewall and NAT Rules and than following your guids step by step.

I cant believe i struggled for so long and In hindsight it was actually really easy to do if you know how.