CODEWITHSUNDEEP
natipsecl2tp
sinopec
sinopec

Reputation: 861

L2TP/IPSec NAT issue

I am a little confusing.

A(L2TP/IPSec VPN server ) ---- B(router) ------ (internet) ------- C(router) ------ D(client)

Can a L2TP/IPSec VPN server(A) behind NAT,serve clients(D) behind other different NATS? Can the IKE message corrected be routed to the L2TP/IPSec VPN server behind NAT?

PS: I dont have any authority to change the B router's NAT configuration. A & D can communicate with the same server who has a public IP address.

Upvotes: 2

Views: 937

Answers (2)

Sam Ginrich
Sam Ginrich

Reputation: 841

Basically you have the problem of hole punching, e.g. here . In this way "strongSwan" p.13 above uses a Mediator Server, which prepares the routing from both endpoints (through their NAT) to the common public network and shares the public addresses/ports of opposite endpoints. So the end points can send messages immediately to each other. With asymmetric NAT this won't work in common. In any case there is no need to touch NAT.

Upvotes: 0

sinopec
sinopec

Reputation: 861

I got the answer myself IKEv2 mediation has a solution for this kind of problem http://www.strongswan.org/docs/LinuxTag2008-strongSwan.pdf

Upvotes: 3

Related Questions