Site to site vpn behind nat'ing router

[sgadsby]

Hello,

I was wondering if it is possible to set up a VPN tunnel between 2 sites? Each site would have a 16XX router behind another NATing router or Firewall, like a Linksys or a Linux box.

Thank you.

[matthew.long]

yes.....depending on your nat device

For a VPN tunnel to work you need to forward the ESP protocol and the ISAKMP Packets using statis Nat. Many cheap Nat routers don't support this type of redirection. Also, if they randomise packet numbering then this can break the VPN as well.

for example on a PIX firewall you would do

station (inside, outside) External_IP Internal_IP netmask 255.255.255.255 0 0

and then permit the IPSEC traffic through via an access list

access-list OUTSIDE_ACCESS_IN permit udp any host External_IP eq isakmp

access-list OUTSIDE_ACCESS_IN permit esp any host External_IP

Start by looking to see it the device support static nat and IPSEC Pass-thru