0

I used VPN to connect site-to-site private networks from A to B. It worked fine. Then I used NAT for (1) hiding private networks and (2) LAN of 2 sites could access the Internet. The problem is that they cannot access each other.

The interruption occurs at router Internet. Looks like it doesn't know which is the next hop to send packets because I used NAT to hide private addresses. So the VPN doesn't work either. How can I fix this?

enter image description here

Improve this question

1 Answer 1

Reset to default
2

I will assume that Router A and Router B have each a public IP address and that they run an IPSec tunnel to each other to/from that public address.

You'll need to (reciprocally) make sure that Router A and Router B will not NAT packets to the remote private subnet, but encapsulate&ecrypt them in the IPSec tunnel and sent to the remote router's public address.

If you provide the relevant configuration sections, we might be able to help better.

Improve this answer
5
  • I did "encapsulate&ecrypto them in the IPSec tunnel and sent to the remote router's public address". But I still don't understand what my teacher means when asking to use NAT so that 2 sites can access the Internet after configuring VPN (it's my homework).
    – Gekko
    May 2 at 15:49
  • 2
    Well, Homework questions are off-topic here. But I think I already gave you half ot the path to the solution. VPN/IPsec will have its rules and config items on what to encapsulate&encrypt, and similarly, there are config items for NAT, defining which traffic to NAT. Adjust rules accordingly.
    – Marc 'netztier' Luethi
    May 2 at 15:53
  • I solved all but this problem and it's only about 5% I swear. As you can see, I'm just providing general information because I want to solve it myself. I just want to know more about my problem and will look into it. Thankyou for helping me. It's very helpful to me.
    – Gekko
    May 2 at 16:04
  • 2
    Then let me rephrase: If your existing PSec definitions say that Site A's private subnet should talk to Site B' private subnet through the IPSec tunnel, you'll probably have an IPsec configuration to match that (Traffic Selectors, Phase2 Proxy IDs, "remote/local subnet" or similar). You'll also have definitions for NAT, to select which locally sourced traffic should be NATted (probably overload/masquerading SourceNAT on the external IF). You'll have to adjust these NAT definitions to exempt site-to-site traffic from NAT.
    – Marc 'netztier' Luethi
    May 3 at 10:46
  • "it's my homework" Unfortunately, all "education, certification, or homework" questions are explicitly off-topic here. Also, you really have not provided enough information to answer the question. There are hundreds of sites on the Internet for education questions such as this.
    – Ron Maupin ♦
    May 3 at 13:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.