Add ability to NAT with IPsec VPN - Balance 305

[adude_sf]

As confirmed by Peplink support, it is not currently possible to NAT IPsec traffic on VPN tunnels terminated on a Balance – sometimes also referred to as D-NAT or S-NAT. We must use another device to perform the NAT before routing to the Balance.

It would be a great benefit to add this NAT functionality to the Balance firmware – many site-to-site VPN tunnels interfacing with Juniper/Cisco equipment require all tunnel traffic to originate from a single IP address (aka. “proxy ID”).

Thank you
Aaron

[Steve]

Ref from: Peplink | Pepwave - Forum

@Steve_Leung

Thanks Aaron, it’s clear now, this definitely make sense.

The main idea of this feature is NAT before the packets go into the IPsec tunnel, it can be translated to a single /32 IP address just like your example above, and we are also considering another use case to do a 1-to-1 NAT mapping, just like the iptables NETMAP extensions do, to help our IPsec users to avoid any network conflict.

I have queued this up on our development roadmap, I can’t give you an exact date of release, but we’ll definitely look into this. Stay tuned.

[adude_sf]

Steve, any further update on this feature request?

We have a need for it with 2 of our VPN counterparties.

Thank you!
-Aaron

[Steve]

Hi Aaron, sorry for the delayed reply. This feature has been added to the queue, but unfortunately there are so many new features coming up, this one is not included in our next firmware release (version 6.2), but this is definitely in our roadmap, please stay tuned.

Anyone else are waiting for this feature as well? Please don’t hesitate to let us know.

[familiatsilva]

Steve,

Hi,

I need that all network traffic be send to the “tune VPN” using a given IP. I would like to know if have some way to do this using PEPLINK 305.

If it’s not possible, can I do this using another equipment or software from PEPLINK?

Thanks

[TK_Liew]

@familiatsilva

Steve,

Hi,

I need that all network traffic be send to the “tune VPN” using a given IP. I would like to know if have some way to do this using PEPLINK 305.

If it’s not possible, can I do this using another equipment or software from PEPLINK?

Thanks

Hi,

Devices at both end of IPSec tunnel will see original IP of each other at the monent. Are you referring to NAT with IPSec also?

[familiatsilva]

Hi

Yes, I want to add ability to NAT with IPsec VPN.

can I do this using another equipment or software from PEPLINK?

Tks

[TK_Liew]

@familiatsilva

Hi

Yes, I want to add ability to NAT with IPsec VPN.

can I do this using another equipment or software from PEPLINK?

Tks

Hi,

You may do this by adding another NAT device behind Peplink. The high level design as below:-

Users —> NAT devices —> B305 --IPSec–> B305 —> Users

[astryukov]

Yes we need it too, I want to add ability to NAT with IPsec VPN.

We just ran in to the issue in our Call Center VPN implementation for VoIP where other side has Cisco and they require have NAT on IPsec.

[jgranade]

We’re waiting on this as well. Client needs 1-to-1 NAT’ing for devices “inside” an IPSec VPN tunnel. The tunnel establishes fine when adding those IP’s as a IPSec “local network” but I need to be able to NAT my PepVPN IP’s to those assigned IPSec tunnel IP’s. The NAT mapping table would work if it didn’t restrict to WAN interfaces. If it would expose those defined IPSec VPN local networks, we’d be in business.

John

[astryukov]

Hello, have should we expect ability to NAT with IPsec VPN any time soon?

[Steve]

This is currently under development, not in any 6.2.x releases though, but very likely it will be available in next major release, please stay tuned