Port Forwarding Over a Site To Site VPN Tunnel.

[walvarez]

Hello guys,  I need the setup in this case. 

My scenario is:  where a Site to Site VPN tunnel has been established between Site A and Site B; a Server behind Site A needs to be accessed by using the WAN IP address of Site B.   (RDP and WEB port 80)

The VPN is UP,  site to site VPN tunnel is already established between the two sites and traffic is flowing between them. 

Attached image of my case

[Toshi_Esumi]

It's not a port forwarding problem but a routing one. The Port forwarding itself has nothing different from the server located at Site B. But if those server accessing sources are anywhere on the internet, you have to have the default route at Site A into the tunnel to get back to Site B, which affect to all other devices Site A.

If the source IPs are limited and known, you can set specific routes back into the tunnel for those without changing the default route at Site A.

[Toshi_Esumi]

A way around is to NAT the forwarding policy to change the source to the tunnel interface IP. Don't forget to assign a set of IPs on both ends of the tunnel, preferably a /30. Then you don't have to even add any routes at Site A. The other end of the tunnel would be a connected route automatically.

[in001]

Hi

We also have a site to site VPN (Fortigate/Zyxel) and want to set up port forwarding. I also understood the problem regarding routing.

Now I have set up a policy route on the other side (Zyxel) but I need to specify a site to site tunnel endpoint there. But the portforwarding comes from the Fortinet WAN and not from a "site to site tunnel"?

How do I have to configure this then?

Hope it is understandable.

Thanks, in

[sw2090]

First of all you have to have routing to your Terminalserver so you can be routed to it coming from the FGT on Side B and getting back from Terminalserver to Side A. 

The last can be the culprit. I'd recommend doing some VIP with snat here to have the traffic natted to a defined IP so you just need to route to and from this and do not need to reset your default route.

In second you have to make sure that traffic from B to Terminalserver (and backwards) matches the p2 selector(s) of your IPSec between A and B because it it doesn't match it will be dropped.

[mle2802]

Hi there,
This document may meet your requirement as we using SNAT for specific source, however, in your scenario is for specific destination. Please refer to this document for more detail "https://community.fortinet.com/t5/FortiGate/Technical-Note-Policy-Based-IPsec-VPN-Using-Source-NAT-a...

Best regards,
Minh

[in001]

Hi

Thanks to both.

But I need the original Source IP on the other site, not a NAT IP. Is that possible?

Thanks