Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a site-to-site VPN set up with a vendor. Let's say the tunnel endpoints are 192.1.1.101 on my side and 192.1.2.0/24 on the vendor's side (which get's NATted to their LAN of 10.x.x.x). This is working fine, I have a SonicWall and I have a VPN policy setup so traffic to 192.1.2.x from my side goes through their VPN and reaches the correct hosts.

The problem is I have an (old, unmodifiable) application that is trying to connect to 10.0.0.10 on their network. If I can make this go through the VPN as if it were 192.1.2.10, then it would reach the correct destination. The vendor is unwilling to add 10.0.0.10 as a tunnel endpoint.

I tried a NAT policy to transform traffic towards 10.0.0.10 to 192.1.2.10, but I believe that doesn't also send it through the VPN because NAT is applied to traffic as it leaves the firewall and after the point where it would have triggered the VPN routing rule. Basically I want to take any traffic to 10.0.0.10, change its destination to 192.1.0.10, and send it through the VPN tunnel for 192.1.0.10. I'm not an expert at firewall config, can someone point me in the right direction?

share|improve this question
    
What type of Sonicwall do you have? –  Nixphoe Jul 24 '11 at 18:26

2 Answers 2

I would stay the NAT rule to rewrite the destination is a good start. To be honest, I would have thought that would be sufficient. Are you certain that traffic is actually hitting your firewall? I assume you don't have a local 10.x.x.x network that these packets are going to.

Other things to try may be a manual routing policy. You could send all 10.x.x.x traffic through your VPN tunnel interface. Also, try setting the VPN as the exit interface on that NAT rule.

--Christopher Karel

share|improve this answer
    
i only have 192.x networks.. i think the only way to make the vpn interface be selectable in the NAT rule is to change the VPN from site-to-site to 'tunnel interface'. I tried that late at night, but couldn't get it to connect to the vendor..I'll read up more on the docs and try again –  dan Jul 25 '11 at 18:05

As well as NATing the traffic did you loop it back to your LAN? You might try using a loop back connection with better results. After that it should be routed to your VPN.

share|improve this answer
    
hey, i can't figure out how to loop it back while keeping the destination 192.1.0.10 so that it routes to the VPN –  dan Jul 25 '11 at 17:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.