How to route Internet traffic through VPN tunnel between two RV1

seyon1234 · ‎07-12-2011

OK, so for reasons I may never understand, after trying the same thing 10 times, it finally worked and viola! my site-to-site VPN between my two RV120W routers works.

However, it hasn't solved the fundamental problem I bought them for. While I can communicate with the IPs on the remote network as if they were on my local network, my Internet traffic isn't going through the VPN tunnel. Any ideas on how I can make that happen?

Put simply, I want to be able to go to http://whatismyipaddress.com/ on my local connection and have the site detect that my IP address is actually that of the remote site (ie: I want all Internet traffic going through the tunnel and out to the public Internet via the remote RV120W).

It sounds simple but I've spent days on this at this point.. a little help please. Thanks.

jasbryan · ‎07-13-2011

Eric,

This is called IPsec ESP Wildcard forwarding ,

How are you're tunnels configured on both side?

Thanks,

Cisco Support Engineer

.:|:.:|:.

seyon1234 · ‎07-13-2011

Is IPsec ESP Wildcard forwarding supported on the RV120W?

For my setup, I used the "Basic VPN Setup" on both local and remote RV120W.

From my side:

Connection name: CY3

Pre-Shared Key: XXXXX (identicle to the one used on the other end)

Remote Gateway: FQDN - A.dyndns.org

Local Gateway: FQDN - B.dyndns.org

Remote LAN (Local Network) IP Address:

192.168.1.0

Remote LAN (Local Network) Subnet Mask:

255.255.255.0

Local LAN (Local Network) IP Address:

192.168.2.0

Local LAN (Local Network) Subnet Mask:

255.255.255.0

On the other side:

Connection name: CY3

Pre-Shared Key: XXXXX (identicle to the one used on the other end)

Remote Gateway: FQDN - B.dyndns.org

Local Gateway: FQDN - A.dyndns.org

Remote LAN (Local Network) IP Address:

192.168.2.0

Remote LAN (Local Network) Subnet Mask:

255.255.255.0

Local LAN (Local Network) IP Address:

192.168.1.0

Local LAN (Local Network) Subnet Mask:

255.255.255.0

I can't seem to find anything in the RV120W manual about ESP Wildcard forwarding though...

jasbryan · ‎07-13-2011

Eric,

Is it supported (no) will it work on the RV120W. Well that is to be determined. I do know in the configuration of the tunnel information it give us the ability to choose 0.0.0.0 so it should work.

whatever side you want to send all traffic to you need to set the tunnel up as,

From my side:

Connection name: CY3

Pre-Shared Key: XXXXX (identicle to the one used on the other end)

Remote Gateway: FQDN - A.dyndns.org

Local Gateway: FQDN - B.dyndns.org

Remote LAN (Local Network) IP Address:

0.0.0.0

Remote LAN (Local Network) Subnet Mask:

0.0.0.0

Local LAN (Local Network) IP Address:

192.168.2.0

Local LAN (Local Network) Subnet Mask:

255.255.255.0

On the other side:

Connection name: CY3

Pre-Shared Key: XXXXX (identicle to the one used on the other end)

Remote Gateway: FQDN - B.dyndns.org

Local Gateway: FQDN - A.dyndns.org

Remote LAN (Local Network) IP Address:

192.168.2.0

Remote LAN (Local Network) Subnet Mask:

255.255.255.0

Local LAN (Local Network) IP Address:

192.168.1.0

Local LAN (Local Network) Subnet Mask:

255.255.255.0

This should pass all traffic from your side over to the remote side.

I would do this after hours for minimize interruption and testing.

I have filled in the blanks thinking you are trying to send all of your traffic to the other side, if this isn't correct you want to reverse this setup.

Thanks,

Jasbryan

Cisco Support Engineer

.:|:.:|:.

seyon1234 · ‎07-13-2011

Hmm.. I think there maybe a bug in the firmware then.

If I try to use 0.0.0.0 for the subnet IP address, I get "Invalid IP address. Please enter a value between 1 - 223 at xxx.0.0.0"

Now, I presume this is why, from the drop down, you can change 'subnet' to 'any.' However, when I do this, then go to the IPSec Connecetion Status page, no policies show up in the table at all. This is despite the fact that, on the Advanced VPN page, the CY3 policy does show up and is enabled (with Remote = "Any").

Any more ideas?

Thanks for your help.

jasbryan · ‎07-14-2011

Eric,

What firmware are you currently running on, ill throw one in the lab when i get a chance and see if they took that ability out.

Thanks,

Jasbryan

seyon1234 · ‎07-14-2011

Both RV120Ws have been upgraded to the latest firmware (1.0.2.6).

You will notice that if you set remote traffic to 'any' then no site-to-site VPN tunnels show up on the status page. If you go to the advanced VPN config page, you will see the name of the VPN policy has an asterix by it.. Couldn't find anything in the manual explaining what that means though.

I have been able to route traffic for individual websites via the subnet option, but that allows only 1 class A address (ie: 140.*.*.*), so it doesn't seem possible to route all Internet traffic unless we can find some kind of workaround.

Thanks again for your help..

jasbryan · ‎07-14-2011

Eric,

Yes, this is my mistake i was thinking about different routers. The RV0 series does have this capabilities(RV042,RV082,RV016) not the RV120 and RV220. I realize this when i got this model(rv120w) out and looked into the web ui

I was thinking if there could be a work around for this , but there isn't. The device(rv120w) just isn't going to be possible to send all Internet traffic over the IPsec tunnel. When choosing ANY on the local side it still uses split tunneling.

You can bring up the release notes on the RV0xx models.

Thanks,

Jasbryan

Cisco Support Engineer

.:|:.:|:.

seyon1234 · ‎07-14-2011

*sigh* ok. Well that's $150 down the drain. Thanks for your help. Can I still use the RV120W on one end, or do I need to swap them both out?

jasbryan · ‎07-14-2011

Should be able to use it on the other end

Jasbryan

How to route Internet traffic through VPN tunnel between two RV120Ws?