mpa
October 16, 2020, 1:42pm
4
I assume you want to skip NAT for IPsec traffic.
This is my solution to the same problem. I set up a VPN zone which allows me to configure firewall policy specific to VPN traffic and separate from WAN and LAN policy.
The wan interface is set up with masquerading (source NAT) by default. This affects both plaintext traffic to the internet and VPN traffic towards the remote LAN. When IPsec decides whether to pass through or to tunnel a packet, it compares the packet's source IP, destination IP, and optionally other header fields with its own configured policy. Masquerading changes the source IP, which causes a mismatch in this comparison, and the packet is not sent through the VPN.
You have to make sure the …
1 Like