Source Nat via VPN Tunnel not working

Question

Dear Helpers, we need to use SourceNAT for our new VPN connection to a client. The VPN connection requirement sheet is attached. The VPN connection is successfully established. For some reason the SourceNAT is not working. Our client asked us to use SourceNAT for our internal network (192.168.100.0/23) and change it to (172.16.11.0/27). We configured the Sophos SNAT-Rule the way we interpreted the requirements, however we are not able to ping the Proxy IDs. 
 Instead, the Traceroute shows we are not able to reach any target behind the Sophos and the traffic is not redirected into the VPN tunnle, or we cannot reach any target through it. 
 Do you have any clue on how to find out where our mistake was made? 
 We also tried changing the Proxy ID and New SourceNetwork, we also tried changing the target destination to the jump server (public ip address) from our client, viewable on the right top of the requirement sheet. 
 Neither of it worked for us. 
 Best regards

BAlfson · Accepted Answer

Hallo and welcome to the UTM Community! 
 You don't need a DNAT since you don't have any internal subnets that overlap with theirs. 
 Your SNAT must have a single IP in 172.16.11.0/27 (a Host) in the 'Change the source to:' field, not the entire /27 subnet. 
 Also, based on the Cisco config, you may want 172.16.200.100/3 1 in the 'Going to:' field instead of /32. 
 You can have multiple SNATs, each with a different, single IP in 172.16.11.0/27 if you want some of your internal traffic to leave with different IPs. 
 If you're still having problems, please show pictures of the Edits of the IPsec Connection and the Remote Gateway. 
 Cheers - Bob

Sophos User3329 · Answer

Hi BAlfson, 
 Thanks for your help, we have adjusted some settings on the other side as you wrote it. 
 After we also configured some other settings, we could see incoming traffic on the other side. 
 So thanks for your help. 
 Best Regards

Source Nat via VPN Tunnel not working

Top Replies