Establishing a Site-to-Site VPN between Azure and a Mobile Router Behind a CGNAT

Question

Establishing a Site-to-Site VPN between Azure and a Mobile Router Behind a CGNAT

cdues 20

I am attempting to gain file access to my Linux device over the internet using WinSCP. However, the mobile router in use may be situated behind a Carrier-Grade NAT (CGNAT) even though it displays a public IPv4 address. I have tried requesting a static IP but received no response from the provider.

To circumvent this issue, I am seeking a solution using Azure and would like to create a Site-to-Site (S2S) VPN with it. Following the S2S Azure VPN tutorial, I have encountered an issue since it requires an "externally facing public IPv4 address" for the VPN device, which my mobile router does not have due to the CGNAT.

Is there a possible workaround for the CGNAT that would allow the S2S VPN to function? Are there any other approaches I should explore? I prefer Azure solutions if any subscriptions are necessary.

KapilAnanth-MSFT 49,321 Reputation points Microsoft Employee

2023-08-04T04:28:30.36+00:00
@cdues

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to establish a S2S Connection between Azure VPN Gateway and a remote site without static Public IP.

I am not aware of CGNAT. I take it that this provides a SNAT to your remote device(mobile router) and the ports may change during the NAT.

If you would like to establish a S2S Connection,

Then it is mandatory to use a fixed Public IP

You must check with your ISP and get a static IP

However, you can also use a FQDN that resolves to your public IP to establish the connection.

i.e, The IP might change, but the FQDN should always point to the recent Public IP.

This can be achieved by creating a LNG with FQDN as EndPoint type.

In case of an existing LNG with IP address as EndPoint type, you will be required to delete and recreate the LNG with FQDN EndPoint

Even in this case, it is mandatory that the mobile router has control over the Public IP and ports to establish the connection.

If you only have one remote device,

You can consider using P2S Connection.

Server configuration (VPN Gateway) : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal

Client configuration (Linux) :https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-cert-linux

Cheers,

Kapil
KapilAnanth-MSFT 49,321 Reputation points Microsoft Employee

2023-08-07T05:17:31.6533333+00:00

@cdues

May I know if you got a chance to review my previous comment?

Please let me know if you are facing any challenges or if there are any follow-up questions, I shall be glad to address them.

Thanks,

Kapil
KapilAnanth-MSFT 49,321 Reputation points Microsoft Employee

2023-08-08T05:16:55.3033333+00:00

@cdues

Reaching out to check if there are any questions on this.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil
cdues 20 Reputation points

2023-08-12T00:49:09.4466667+00:00

I have looked into the P2S VPN and it may be viable but I am not currently perusing this option. Setting up a VPN is not for the inexperienced and is overall more costly than I anticipated. I am hoping to complete this task using the lowest cost Azure Virtual Machine and with a reverse SSH connection.
KapilAnanth-MSFT 49,321 Reputation points Microsoft Employee

2023-08-16T09:54:12.78+00:00
@cdues

Thanks for the update.

If you only have one remote device, You can consider using P2S Connection.

If you have a site, then I would suggest it is better to stick to the Validated devices for S2S Connection I shall summarized my comments and posted it as a new answer.

I would highly appreciate if you could Accept the answer and close this thread

Original posters help the community find answers faster by identifying the correct answer.

Cheers,

Kapil

Your answer

KapilAnanth-MSFT 49,321 Reputation points Microsoft Employee

2023-08-04T04:28:30.36+00:00

@cdues

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to establish a S2S Connection between Azure VPN Gateway and a remote site without static Public IP.

I am not aware of CGNAT. I take it that this provides a SNAT to your remote device(mobile router) and the ports may change during the NAT.

If you would like to establish a S2S Connection,

Then it is mandatory to use a fixed Public IP

You must check with your ISP and get a static IP

However, you can also use a FQDN that resolves to your public IP to establish the connection.

i.e, The IP might change, but the FQDN should always point to the recent Public IP.

This can be achieved by creating a LNG with FQDN as EndPoint type.

In case of an existing LNG with IP address as EndPoint type, you will be required to delete and recreate the LNG with FQDN EndPoint

Even in this case, it is mandatory that the mobile router has control over the Public IP and ports to establish the connection.

If you only have one remote device,

You can consider using P2S Connection.

Server configuration (VPN Gateway) : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal

Client configuration (Linux) :https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-cert-linux

Cheers,

Kapil
KapilAnanth-MSFT 49,321 Reputation points Microsoft Employee

2023-08-07T05:17:31.6533333+00:00

@cdues

May I know if you got a chance to review my previous comment?

Please let me know if you are facing any challenges or if there are any follow-up questions, I shall be glad to address them.

Thanks,

Kapil
KapilAnanth-MSFT 49,321 Reputation points Microsoft Employee

2023-08-08T05:16:55.3033333+00:00

@cdues

Reaching out to check if there are any questions on this.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil
cdues 20 Reputation points

2023-08-12T00:49:09.4466667+00:00

I have looked into the P2S VPN and it may be viable but I am not currently perusing this option. Setting up a VPN is not for the inexperienced and is overall more costly than I anticipated. I am hoping to complete this task using the lowest cost Azure Virtual Machine and with a reverse SSH connection.
KapilAnanth-MSFT 49,321 Reputation points Microsoft Employee

2023-08-16T09:54:12.78+00:00

@cdues

Thanks for the update.

If you only have one remote device, You can consider using P2S Connection.

If you have a site, then I would suggest it is better to stick to the Validated devices for S2S Connection I shall summarized my comments and posted it as a new answer.

I would highly appreciate if you could Accept the answer and close this thread

Original posters help the community find answers faster by identifying the correct answer.

Cheers,

Kapil

Share via

Establishing a Site-to-Site VPN between Azure and a Mobile Router Behind a CGNAT

Your answer