Connecting to an IPsec endpoint from behind the Firewall

Last modified on 1 Dec, 2022. Revision 8
This article describes how to connect to an IPsec endpoint from behind the Firewall (client on LAN -> Wan_ip)
Up to date for
cOS Core 14.00.06
Supported since
cOS Core 11.x
Status OK
Peter Nilsson


I want to configure a roaming/roadwarrior IPsec client/server setup where I can can connect to the Firewall VPN server from the Internet but also from inside/behind the firewall. But when i try to connect with the client from the inside nothing happens, the Firewall does not reply at all.


The Firewall behaves this way because the IPsec engine expects that the interface where the request was received will be the sending interface as well. But if you connect to e.g. WAN from LAN it will be the LAN interface that will be the sender interface towards the client.

The solution to this problem is straightforward. Configure the Local Endpoint setting on the IPsec tunnel to be the IP address of the external interface, as shown in the screenshot below:

Now, the IPsec engine and cOS Core will know which IP address it should use as the sender IP even if the sender interface is the internal LAN interface.

Note: In older cOS Core versions where the Local Endpoint setting does not exist, the solution is to set the same IP address on both WAN and LAN interface.

Related articles

Configuring L2TP/IPsec Server using PSK
11 Jan, 2023 ipsec core vpn
Configuring public certificates in NetWall firewalls
23 Aug, 2022 core certificate oneconnect ipsec vpn
Problem with auto-created Core routes
22 Mar, 2021 core ipsec routing
IPsec license usage calculation
14 Apr, 2021 core license ipsec
Does IPsecBeforeRules trigger before Access rules?
8 Sep, 2020 core ipsec rules access
Partial split tunneling when using Windows L2TP/IPsec
27 Jan, 2023 ipsec core windows vpn l2tp
Troubleshooting IPsec tunnels (IKEv1)
7 Dec, 2022 ipsec ike troubleshoot core
Freeing up more memory in the Firewall
23 Aug, 2022 core connections ipsec memory