PepVPN connection to non-public IP address via IC2


#1

Background:
One Pepwave MAX Transit Duo with two cellular lines.

  • Line 1 has a fixed IP address, is slow and expensive.
  • Line 2 has a dynamic carrier NAT address (10.xxx.xxx.xxx), is fast and (relatively) inexpensive.

One Balance 380 with multiple lines with private, static IP addresses (i.e., they can reach out to a fixed IP address to set up the VPN, but not vice versa due to firewall rules).

Objective:
Establish a PepVPN connection between the B380 and Line 2 of the Transit using IC2.

Attempt 1 (failed):
On the transit have both lines active/enabled with the same priority.
In IC2 set up a point-point VPN connection between the B380 and the Max Duo, with the priority in the WAN settings of IC2 being to give line 2 priority for the VPN connection.
The VPN succeeds in being established, but the connection is to cellular line 1 (the fixed IP address) and does not switch to line 2 even though line2 is enabled.
Tweak:
After establishing the connection, change Line 1 from priority 1 to priority 2. Line 1 now is on standby, but the VPN connection stays with line 1 instead of shifting to the (no top priority) line 2.

Attempt 2 (failed)
As with attempt 1, but with line 1 of the transit set to priority 2 (so it is on standby).
No connection gets established (as expected - the two IP addresses cannot be reached from their respective outsides for the initiation of the setup).

Hope:
That once the connection was established in attempt 1 the transit would move its end of the VPN from Line 1 to the IC2-preferred WAN line 2.
Not happening…

Any suggestions?

Additional question:
If SpeedFusion were enabled in this case (extra license required), would both cellular lines become bonded? And if so, if line 1 became disabled, would the SpeedFusion connection stay up?


#2

Do you think this meets your requirement?

Ensure tunnel1 is ties to cellular1 and tunnel2 is ties to cellular2. Then create Priority outbound rule to route all traffics into tunnel2. Of course, you need SpeedFusion license for Max Transit.


#3

That looks promising. However, the setup described is in terms of the local webadmin on the endpoints.
For the management of this network we are using IC2, and I have not found corresponding options to create multiple tunnels using the IC2 configuration tools, and for connections set up using IC2 we seem not to be allowed to open the corresponding profiles using the local webadmin.

Please advise.


#4

@zegor_mjol

It’s scheduled feature for IC2. As last check it’s targeted for version 2.8. Let me further check with the team and confirm whether IC2 version 2.8 will included the feature. I will post again when get the latest news :blush: