joelwampler

Unifi IPSEC Double NAT Tweak

Steps

1. Setup Site-to-Site IPSEC VPN tunnel on both sides (just choose the internal IP for NAT'd device)
2. Setup port forwarding on all routers involved to expose UDP ports 500 and 4500 from the Internet to the Unifi Gateway/Dream Machine/Dream Router (hereinafter referred to as gateway)
3. ssh to the gateway (enable SSH first if necessary)
4. Edit appropriate config file in /run/strongswan/ipsec.d/tunnels on the gateway that needs to traverse multiple NAT devices
5. Add leftid parameter to config (example below)
6. run ipsec reload

The config will be overwritten if any settings are changed via the GUI, and sometimes on firmware updates.. It appears you cannot persist these modifications at this time.

joelwampler

### Keybase proof

I hereby claim:

  * I am joelwampler on github.
  * I am joelwampler (https://keybase.io/joelwampler) on keybase.
  * I have a public key whose fingerprint is 91AA A4A3 FC75 EA6D 211B  9C02 0CC7 31CB 1871 7BD7

To claim this, I am signing this object:

joelwampler

diff --git a/help/C/gs-tabs.page b/help/C/gs-tabs.page
index ea4ea6b..67dbba1 100644
--- a/help/C/gs-tabs.page
+++ b/help/C/gs-tabs.page
@@ -5,6 +5,7 @@
 
   <info>
     <link type="guide" xref="index#getting-started"/>
+    <link type="seealso" xref="pref-title"/>
     <revision pkgversion="3.8" date="2013-02-17" status="candidate"/>