Netmap planner
When two sites joined by a VPN use the same network, enter each site's real and mapped network and the planner gives you the VPN and NETMAP settings for both firewalls. See Netmap for how the rules work.
Networks
Site A
Site B
How a packet from site A reaches site B
Leaves site A
Source
192.168.1.10Destination
10.2.2.20NETMAP_SRC_ASite A firewall rewrites the sourceThrough the VPN
Source
10.1.1.10Destination
10.2.2.20NETMAP_DST_BSite B firewall rewrites the destinationReaches site B
Source
10.1.1.10Destination
192.168.1.20Configuration
Site A
1. VPN tunnel
Use the mapped networks, never the real ones.
| Local network | Remote network |
|---|---|
| 10.1.1.0/24 | 10.2.2.0/24 |
2. Firewall › NAT › Rules and NETMAP › Add source NETMAP
Source NETMAP
| Name | Destination network | Source network | Mapped network |
|---|---|---|---|
| NETMAP_SRC_A | 10.2.2.0/24 | 192.168.1.0/24 | 10.1.1.0/24 |
3. Firewall › NAT › Rules and NETMAP › Add destination NETMAP
Destination NETMAP
| Name | Source network | Destination network | Mapped network |
|---|---|---|---|
| NETMAP_DST_A | 10.2.2.0/24 | 10.1.1.0/24 | 192.168.1.0/24 |
Site B
1. VPN tunnel
Use the mapped networks, never the real ones.
| Local network | Remote network |
|---|---|
| 10.2.2.0/24 | 10.1.1.0/24 |
2. Firewall › NAT › Rules and NETMAP › Add source NETMAP
Source NETMAP
| Name | Destination network | Source network | Mapped network |
|---|---|---|---|
| NETMAP_SRC_B | 10.1.1.0/24 | 192.168.1.0/24 | 10.2.2.0/24 |
3. Firewall › NAT › Rules and NETMAP › Add destination NETMAP
Destination NETMAP
| Name | Source network | Destination network | Mapped network |
|---|---|---|---|
| NETMAP_DST_B | 10.1.1.0/24 | 10.2.2.0/24 | 192.168.1.0/24 |
Test with two example hosts
From 192.168.1.10 (site A), to reach 192.168.1.20 (site B): ping 10.2.2.20
From 192.168.1.20 (site B), to reach 192.168.1.10 (site A): ping 10.1.1.10
Site B sees the connection coming from 10.1.1.10. Use that address in firewall rules and look for it in the logs.
Good to know
- Firewall rules between the two sites use the other site's mapped network.
- The mapped networks must not exist at either site or in any other VPN.
- A DNS name that resolves to a host's real IP at the other site won't work. Use the mapped address instead.