I want to setup two IPSec tunnels using two different Google Cloud VPN gateways --
GW_IP_2 -- with two behind-NAT routers --
R2. Something like this:
GW_IP_1 ---\ /--- R1 |-- my_main_router_NAT_firewall ---| GW_IP_2 ---/ \--- R2
The problem: forward
500 to specific routers (
R2) based on source IP address of a gateway (
I ended up in a strange situation: one tunnel is up and packets are matching and are forwarded correctly, but packets for the second router, R2 are not matching and it looks like they disappear somewhere.
On the main NATting router I created DNAT rules:
-t nat -A PREROUTING -p udp -s GW_IP_1 --dport 500 -j DNAT --to R1:500 -t nat -A PREROUTING -p udp -s GW_IP_2 --dport 500 -j DNAT --to R2:500
tcpdump on both
R1 got the packet and bring up the tunnel, but the R2 does not see any packets to 500. I then run
tcpdump on the
main_router too -- packets from both
GW_IP_2 are arriving as expected.
I spent several days fighting with the routers (Ubiquiti ER-X), etc. thinking that this is a firmware bug or something specific for this type of routers. But then I setup a simple Linux router from the start -- with two interfaces, forwarding and all rules and the result is the same -- one tunnel is up (packets are forwarded correctly) and the second router does not receive any packets.
So this is probably something more fundamental to
Could someone explain?