We have the following setup : vyos in datacenter with public IP, and vpn ipsec tunnel to company with checkpoint firewall.
In the company there is running a webserver.
100.100.100.100 (Public ip vyos) → DNAT to 192.168.1.3 (traffic over vpn tunnel to company public ip 200.200.200.200) (https)
I can ping from the vyos to the company, the ipsec tunnel is up.
i can ping from the webserver 192.168.1.3 to then 172.20.10.50
But https to the webserver do not work. What is wrong?
interfaces {
ethernet eth0 {
address 100.100.100.100/25 public ip
}
ethernet eth2 {
address 172.10.10.50/24 local ip
}
loopback lo {
}
}
nat {
destination {
rule 500 {
description DNAT to company webserver
destination {
port 443
}
inbound-interface eth0
log
protocol tcp
translation {
address 192.168.1.3
}
}
}
source {
rule 6 {
destination {
address 192.168.1.0/24
}
exclude
outbound-interface eth0
source {
address 172.10.10.0/24
}
}
rule 10 {
outbound-interface eth0
source {
address 172.10.10.0/24
}
translation {
address masquerade
}
}
rule 11 {
outbound-interface eth0
source {
address 192.168.1.0/24
}
translation {
address masquerade
}
}
}
}
protocols {
static {
route 0.0.0.0/0 {
next-hop 100.100.100.100 {
}
}
}
}
service {
dns {
forwarding {
allow-from 172.10.10.0/24
listen-address 172.10.10.50
name-server 8.8.8.8
name-server 8.8.4.4
}
}
ssh {
port 22
}
}
vpn {
ipsec {
esp-group ESP-1W {
compression disable
lifetime 3600
mode tunnel
pfs enable
proposal 1 {
encryption aes256
hash sha1
}
}
ike-group IKE-1W {
close-action none
dead-peer-detection {
action restart
interval 15
timeout 30
}
ikev2-reauth no
key-exchange ikev1
lifetime 86400
proposal 1 {
dh-group 2
encryption aes256
hash sha1
}
}
ipsec-interfaces {
interface eth0
}
site-to-site {
peer 200.200.200.200 {
authentication {
id 100.100.100.100
mode pre-shared-secret
pre-shared-secret ****************
remote-id 200.200.200.200
}
connection-type initiate
default-esp-group ESP-1W
ike-group IKE-1W
ikev2-reauth inherit
local-address 100.100.100.100
tunnel 0 {
allow-nat-networks disable
allow-public-networks disable
local {
prefix 172.10.10.50/24
}
remote {
prefix 192.168.1.0/24
}
}
}
}
}
}