External Traffic to a Private IP on a VPN tunnel

[kyoto5]

Ive had a request which Im not even sure is possible. Devs want to have a third party cloud service talk to a system that is inside our network but at the other end of a vpn tunnel. Is that even possible? The path would be something like this:

3rd party public IP - our firewall - s2s tunnel - remote network private ip.

I wonder if its as simple as a NAT rule which says 3.x.x.x (3rd party) - 189.x.x.x (our firewall ip), translate that to 192.168.x.x private IP, and then the firewall will route that down the tunnel?

[Kasun Bandara]

yes as i understood, you need to allow access private IP from 3rd part public ip. you can do static NAT at your firewall and after that its matter of routing through tunnel and local network