Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 10 Feb 2003 14:40:53 +0200
From:      Willie Viljoen <will@unfoldings.net>
To:        "Pranas Baliuka" <pranas.baliuka@danet.lt>
Cc:        freebsd-questions@freebsd.org
Subject:   Re: How to avoid NAT for VPN addresses
Message-ID:  <200302101440.53269.will@unfoldings.net>
In-Reply-To: <GJEILDLAECGOPIJCPEFJMEMECGAA.pranas.baliuka@danet.lt>
References:  <GJEILDLAECGOPIJCPEFJMEMECGAA.pranas.baliuka@danet.lt>

next in thread | previous in thread | raw e-mail | index | archive | help
Because (I assume) you have only one IP address, anything behind your 
gateway has to get NATed for it to be able to connect to the internet. A 
VPN connection (generally) has to run two ways, so doing it behind NAT will 
be problematic. The best thing to do is either to apply for a routable IP 
address range (a /28 range will do for most networks) and route real IP via 
your gateway (make sure to firewall properly) If that's not possible, get 
them to assign extra IPs to you, of the same number as the amount of boxes 
you have doing VPN, then set up the addresses as aliases on your gateway 
and do static NAT. If your VPN solution has the ability to set the port it 
communicates on, you could also use portforwarding from the gateway to the 
machines, but that is problematic at the best of times.

If you *HAVE* routable IP ranges behind your NAT and you simply want them to 
bypass the NAT, the easiest way is to run natd with the -u switch. This 
will cause natd to only operate on unregistered (eg, 10.0.0.0/8, 
192.168.0.0/16) addresses.

Will

On Monday 10 February 2003 15:26, Pranas Baliuka wrote:
> Can someone explain me how to avoid NAT for specific IP ranges?
> I have configured IPSec (racoon and setkey) VPN works with gateway
> (FreeBSD 4.6), but windows workstations are not able to use VPN
> connections. I guess there are collisions with NAT and IPSec, but I need
> NAT for accessing internet via my ISP.
>
> Thanks,
> Pranas Baliuka
>
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-questions" in the body of the message

-- 
Willie Viljoen
Freelance IT Consultant

214 Paul Kruger Avenue, Universitas
Bloemfontein
9321
South Africa

+27 51 522 15 60
+27 51 522 44 36 (after hours)
+27 82 404 03 27 (mobile)

will@unfoldings.net

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200302101440.53269.will>