0

I was configuring an IPSec VPN and somehow I can't figure out what the inner/outer IP of my gateway would be.

Have a look at this image : NAT-T IPSec Imagine I have my site-to-site VPN, with my gateway having the IP 192.168.0.1. This IP gets NAT'd by our firewall into a public IP.

If I have a client behind the VPN, say with IP 172.16.0.1, I know the Inner IP would be 172.16.0.1 and the outer IP would be 192.168.0.1, which would then get NAT'd.

But what if it was my IPSec gateway trying to send a packet to a host behind the other IPSec gateway ? What would be the inner/outer IP ? Would it be twice the same IP, i.e. 192.168.0.1 in inner, and 192.168.0.1 in outer ?

2

That depends on the IPsec policies that are negotiated with the other IPsec gateway. To actually be able to tunnel traffic from 192.168.0.1 there has to be a matching IPsec policy. If only a policy between e.g. 172.16.0.0/24 and a remote subnet is negotiated, the server can't tunnel traffic from 192.168.0.1 it would have to use its IP address within the 172.16.0.0/24 subnet (assuming it has one). If IPsec policies for both addresses are negotiated it depends on the source address selection (routing table etc.) which IP address the gateway uses to send traffic to the remote subnet.

  • My question obviously implies that the 192.168.0.0/24 network is part of the IPSec policy. – Julien Jul 6 '18 at 8:31
  • 1
    Not really, but OK. – ecdsa Jul 6 '18 at 8:45
  • Now that you have edited your answer, it is complete and actually answers my question. – Julien Jul 6 '18 at 12:16
0

Theoretically, yes the Inner source IP and Outer source IP would both be 192.168.0.1.

In practice it is dependent on the OS and implementation as to whether it would attempt to tunnel the traffic from the same source that it is using as the tunnel source IP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.