<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">I assume you are using a cisco router or similar for this?<div><br></div><div>You basically need to put a deny rule into the nat acl matching the destination range that exists on the remote side of that ipsec tunnel before the nat permit rule.</div><div><br></div><div>If you could give some more details about the router I could give you a more definitive example.</div><div><br></div><div>PS: yup (*%&*$ing NAT.</div><div><br><div><div>On 1 May 2014, at 2:15 pm, Geordie Guy <<a href="mailto:elomis@gmail.com">elomis@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">Hi Folks,<div><br></div><div>I have a problem whereby traffic going from an IP is NATted to allow access to the Internet from that IP, with a rule that NATs anything from <a href="http://10.2.6.0/24">10.2.6.0/24</a> with a PAT rule for 103.247.65.254. This isn't remarkable, everything internal goes to the rest of the LANs, anything heading out is NATted. Traffic has historically either gone to the Internet or another local l3 network.</div>
<div><br></div><div>An IPSEC tunnel has been established to a business partner and traffic from this IP going to 172.31.1.3 has to go to them via the tunnel, but the NAT rule is catching it and NATting it because it isn't destined to a local network, but to the outside world (albeit after being encrypted and encapsulated). This is stopping the traffic entering the tunnel.</div>
<div><br></div><div>I'd thought of adding a new interface to the box in question and decreasing the scope of the NAT rule so that a particular subnet of <a href="http://10.2.6.0/24">10.2.6.0/24</a> isn't covered, but that would necessitate doing some jiggery pokery to somehow make sure the multihomed host uses one particular interface and source IP to try and go to the partner. Is there a way of exempting a particular IP address or providing some other criteria for a NAT rule?</div>
<div><br></div><div>- Geordie</div><div><br></div><div><br></div><div>PS: (*%&*$ing NAT. </div><div><br></div><div><br></div></div>
_______________________________________________<br>AusNOG mailing list<br><a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>http://lists.ausnog.net/mailman/listinfo/ausnog<br></blockquote></div><br></div></body></html>