I was configuring an IPSec VPN and somehow I can't figure out what the inner/outer IP of my gateway would be.

Have a look at this image : NAT-T IPSec Imagine I have my site-to-site VPN, with my gateway having the IP This IP gets NAT'd by our firewall into a public IP.

If I have a client behind the VPN, say with IP, I know the Inner IP would be and the outer IP would be, which would then get NAT'd.

But what if it was my IPSec gateway trying to send a packet to a host behind the other IPSec gateway ? What would be the inner/outer IP ? Would it be twice the same IP, i.e. in inner, and in outer ?


That depends on the IPsec policies that are negotiated with the other IPsec gateway. To actually be able to tunnel traffic from there has to be a matching IPsec policy. If only a policy between e.g. and a remote subnet is negotiated, the server can't tunnel traffic from it would have to use its IP address within the subnet (assuming it has one). If IPsec policies for both addresses are negotiated it depends on the source address selection (routing table etc.) which IP address the gateway uses to send traffic to the remote subnet.

  • My question obviously implies that the network is part of the IPSec policy.
    – Julien
    Jul 6 '18 at 8:31
  • 1
    Not really, but OK.
    – ecdsa
    Jul 6 '18 at 8:45
  • Now that you have edited your answer, it is complete and actually answers my question.
    – Julien
    Jul 6 '18 at 12:16

Theoretically, yes the Inner source IP and Outer source IP would both be

In practice it is dependent on the OS and implementation as to whether it would attempt to tunnel the traffic from the same source that it is using as the tunnel source IP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.