TL;DR Can a Sonicwall TZ200 series port-forward to a host not on the local internal subnet? If so, can that host be one accessed through a VPN tunnel with the Sonicwall as one endpoint?
We have an application running at a remote (third-party) site that we'd like to make available from outside the office networks. Setting up direct access to that site may be possible, but for a couple of reasons we'd like to funnel that traffic through the main office site if possible. There is an always-up IPSEC VPN between the sites, and the systems involved are all Windows-based servers. The third-party router is a Cisco/Linksys RVxxx.
I know I could probably do Rube Goldberg-ish things involving SSH tunnels from internal Linux boxes, but I'd either suck it up and relocate the server or get it opened up at the third-party site before doing anything like that.
Basically what I'm wondering is
- Is it possible?
- Is it feasible - maintenance nightmares, mystery connections and instability would all be problems, and even if I document an obscure and esoteric configuration (see SSH above), nobody reads documentation.
- If it's both possible and feasible, how should I be setting it up? I assume I'd be dealing with the NAT and Access Rules, anything else? My VPN experience is generally with site-to-site tunnels on routers with less configurability than Sonicwalls.
- What are the catches (e.g. the problem with spoof detection dropping packets that someone ran into with A-B-C routing)?
This question is similar to Client access cross location through VPN tunnel, but I'm not finding the sole answer to that one particularly useful and I'm unconcerned about DNS and WINS in this case.