Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 27 replies
  • Answers 1 answer
  • Subscribers 7 subscribers
  • Views 43328 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Routing single local host internet traffic through remote IPSec tunnel gateway

Marcello Reggiore

Hi to all,

I have one UTM 9 at HQ site and one UTM 9 at branch site with IPSec Active tunnel between them.

I would like, only for some specific hosts in HQ site,  to  present themselves on Internet using Branch site WAN IP address instead of HQ wan IP.

It is possible with some SNAT / routing rule? What would be the best way to address it?

 

thank you all



This thread was automatically locked due to age.
  • 0 in reply to BAlfson

    Similar setup in the sense that I have a branch office and a HQ and trying to route all the internet bound traffic for a subnet to another site for an exit point.

    I tried with the policy based route which breaks the connection and doesn’t work / nothing pings or routes.

    If I try adding 0.0.0.0 to the IPSec tunnel - the tunnel doesn’t establish.

    My question I poorly worded last night was - do I need two entirely independent tunnel connections or just the subnets to be listed separately in the local/remote networks on either side respectively ?

  • 0 in reply to Aaron Becker

    Show us pictures of the Edits of the IPsec Connection and Remote Gateway for both sides and tell us if/where Web Filtering is being done - the exit point site or not or both.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Well, now I can get the tunnel to establish (I believe it was a double-NAT issue on the "Branch" side). My goal here is get only one specific subnet to route its internet traffic via a second ipsec tunnel.

    Unfortunately, when I get the tunnel to establish, all the branch side sophos traffic (as in, traffic generated on the Sophos itself) seems to try and go through the tunnel or just quits working altogether. Traceroute no longer works, cannot ping externally, etc. A review of the routes under Support>Advanced shows that the Sophos is trying to default all traffic via the new tunnel.

    This isn't the intended routing so first and foremost I need to find a solution to this. 

    The branch Sophos has 1 NAT rule that routes internet bound traffic from a source of "any" out on a WAN public IP of the branch Sophos. 

  • 0 in reply to Aaron Becker

    Pictures please!

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to Aaron Becker

    Branch Screenshots:

    HQ FW:

     

    There is a second tunnel (which is the primary production tunnel at the moment) that is set up the same except it has the production subnets routed between the two sites. 

  • 0 in reply to Aaron Becker

    In BO_GUEST_FIREWALL, do you have a Masquerading rule like 'BO_Guest -> External'?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Heres the NAT rules. I don't have any masq rules active. I have a masq rule that I've activated when the secondary tunnel (the tunnel listed above) is up from GUEST_NETWORK>INTERNAL ... which I guess in hindsight isn't correct, but I'm not sure why it wouldn't be covered in the below NAT rule...

Unfiltered HTML