NAT Through IPSEC Tunnel

Networking Solutions
1

Hi

We are having issues with NAT on a Teltonika RUT951.

Our LAN is:
Laptop 172.16.1.1
Teltonika LAN 172.16.1.254

The Laptops Default gateway is set to 172.16.1.254

We have a Fixed IP SIM Card in the RUT 951.

We have an IPSEC tunnel from the RUT951 to a remote firewall with its own DMZ
The remote Peer identifier is a Public IP at the Firewall
The local Peer identifier the SIMS Fixed IP.

IPSEC tunnel establishes OK.

The RUT951 IPSEC Connection settings are:

Local Subnet 172.16.1.0/24
Remote Subnet 192.168.210.0/24

If I ping from the laptop to 192.168.210.1 then the traffic traverses the IPSEC Tunnel
The remote firewall shows this traffic coming from 172.16.1.1
All good there

However, we would like to NAT the traffic at source.
If I put a NAT rule on the RUT 951, to NAT traffic from
source 172.16.1.1
Destination 192.168.210.0/24 or 192.168.210.1 etc
Rewrite IP to 192.168.200.20 (or any IP)
Outbound zone: WAN
This NAT doesn’t happen.
The Source IP arriving at the remote firewall, through the tunnel always remains 172.16.1.1

Can you provide any assistance

Thanks

3

Hello,

Thank you for reaching out and your inquiry.

Your request is currently under review and analysis. Once the evaluation is complete, I will get back to you with further information, findings, or suggestions.

Thank you for your patience in the meantime.

Best regards,

4

Hello,

I assume this SNAT traversal could be achieved with one of the following iptables rules added to the Custom Firewall Rules section (Network → Firewall → Custom Rules). Could you try adding the following:

iptables -t nat -I POSTROUTING -d 192.168.210.0/24 -j SNAT --to-source 192.168.200.20

(Change the source IP to the one you’d like to use).

If the above rule doesn’t work, try this one:

iptables -t nat -A POSTROUTING -s 172.16.1.1 -d 192.168.210.0/24 -j SNAT --to-source 192.168.200.20

Let me know how it goes after testing.

Best regards,