Connecting to an IPsec endpoint from behind the Firewall

Problem

I want to configure a roaming/roadwarrior IPsec client/server setup where I can can connect to the Firewall VPN server from the Internet but also from inside/behind the firewall. But when i try to connect with the client from the inside nothing happens, the Firewall does not reply at all.

Solution

The Firewall behaves this way because the IPsec engine expects that the interface where the request was received will be the sending interface as well. But if you connect to e.g. WAN from LAN it will be the LAN interface that will be the sender interface towards the client.

The solution to this problem is straightforward. Configure the Local Endpoint setting on the IPsec tunnel to be the IP address of the external interface, as shown in the screenshot below:

Now, the IPsec engine and cOS Core will know which IP address it should use as the sender IP even if the sender interface is the internal LAN interface.

Note: In older cOS Core versions where the Local Endpoint setting does not exist, the solution is to set the same IP address on both WAN and LAN interface.

Related articles