NAT-Related Scenarios

This section details some of the NAT related VPN services deployment scenarios.


Can I use NAT for both the master and the slaves?

Use only Static NAT and ensure that it is on a separate box than the VPN master or slave.

Figure 5
NBM 3.7 without NAT

Figure 6
NBM 3.8 VPN with NAT


Steps to Deploy:

  1. If you have any NBM 3.7 server in the network, you need to first upgrade all the NBM 3.7 servers to NBM 3.8 servers.

  2. After that, configure the NBM 3.8 servers and ensure that they are working properly.

  3. Configure the Static NAT and put the NBM 3.8 servers behind the NAT boxes.


Should I keep NAT and VPN on the same machine or on different machines?

You should always keep the NAT and VPN on separate machines.


Steps to Deploy:

  1. Before configuring the VPN services on the NBM 3.8 machine, ensure that Static NAT is working.

  2. Configure the VPN services on the NBM 3.8 machine with the public IP address on which the VPN service is to run.


Testing Your Configuration:

  1. After configuring the Static NAT, ensure the traffic from the NAT to the VPN server is flowing properly.

What should I do to move existing VPN servers behind NAT?

You should have the NBM 3.8 as the VPN master server. If you are moving a server behind NAT make sure either any of the other master servers in the VPN network is upgraded to NBM 3.8, or move a VPN slave server behind NAT. Moving the VPN master server behind NAT has no issues.

We recommend that the VPN and NAT are on the different machines.


Steps to Deploy:

  1. Configure a static NAT server by mapping the secondary IP address of the NAT server to the VPN server private IP address.

  2. In the VPN server set the default route as the NAT server's private interface.

  3. Reconfigure the VPN server configuration with the secondary IP address of the NAT server.

  4. Ping the secondary IP address from the public machine. The traffic should get diverted to the VPN server.

  5. If the VPN server moved is a VPN master server you need to create new keys by using vpncfg and should add other VPN members to this master server.


Testing Your Configuration:

  1. Establish the VPN tunnel by pinging to the tunnel IP address.