Huawei USG firewall no-nat config for ipsec traffic

bash 复制代码

nat-policy
 rule name ipsec
  source-zone trust
  destination-zone untrust
  source-address 10.248.1.0 mask 255.255.255.0
  destination-address 10.250.1.0 mask 255.255.255.0
  action no-nat
  
 rule name To-Internet
  action source-nat easy-ip

In IPsec VPNs, "no-NAT" (often seen as no-NAT, no NAT, or NAT bypass) refers to a configuration rule that exempts VPN traffic from network address translation (NAT).

Here's a plain-English breakdown of what it means and why it matters:

The Core Idea

Normally, when a device on your local network sends traffic to the internet, your router performs Source NAT (specifically MASQUERADE or PAT). It changes the device's private IP (e.g., 192.168.1.10) into the router's public IP address so the traffic can travel over the internet.

"No-NAT" tells the router: "Do NOT do this for traffic going to the VPN." Instead of replacing the private IP with the public IP, the router leaves the original private IP intact and sends it directly through the VPN tunnel.

Why Do You Need This?

IPsec VPNs have two main modes:

复制代码

Tunnel Mode (most common for site-to-site): The entire original packet is encrypted and wrapped in a new IP header. In this case, NAT is often not needed because the new outer header handles routing. However, you still need a no-NAT rule to prevent the router from changing the inner (original) IP addresses.

Transport Mode (often used for client-to-site): The original IP header is not changed. If you NAT the traffic, the VPN gateway on the other side will see the router's public IP instead of the client's real private IP. This breaks:

    Access controls (firewall rules on the remote side that trust specific internal IP ranges).

    Logging (you lose track of which actual user made a request).

    Application functionality (some apps rely on the client's real IP for sessions or licenses).

How It Works in Practice

A typical router has a NAT rule like:

复制代码

Source IP = 192.168.1.0/24 → Interface = WAN → NAT (change to public IP)

To make the VPN work, you add a no-NAT rule that sits above the general NAT rule:

复制代码

Source IP = 192.168.1.0/24 → Destination = 10.0.0.0/8 (the remote VPN subnet) → DO NOT NAT

Because firewall rules are processed in order (top-down), the router sees the VPN-bound traffic first and skips NAT. All other internet traffic hits the general rule and gets NATed as usual.

What Happens If You Forget No-NAT?

复制代码

Site-to-site VPN: The remote side receives packets with your router's public IP, not the internal IP. If the remote side expects traffic only from 192.168.1.0/24, it will drop the packets because they appear to come from the wrong source.

Client-to-site VPN: The VPN server assigns an IP to the client, but the server sees all users coming from the same public IP. It cannot distinguish between different users, and internal network resources may not work correctly.

A Quick Analogy

Imagine you're in a large office building (your LAN). You want to send an internal memo to a colleague on the 5th floor (the VPN subnet).

复制代码

With NAT: The mailroom (router) erases your internal office number, writes the building's main street address on it, and sends it out. The colleague on the 5th floor gets it, but has no idea which office it came from.

With No-NAT: The mailroom sees the memo is destined for the 5th floor, leaves your internal office number intact, and delivers it directly. Your colleague knows exactly who sent it.

Key Terms You Might See Instead

复制代码

NAT Exemption

NAT Bypass

Policy-Based NAT (with a rule that excludes VPN destinations)

"Don't NAT" or "No SNAT" (Source NAT)

In Summary

No-NAT is a firewall/policy rule that ensures IPsec VPN traffic is not source-translated. It preserves the original internal IP addresses so the remote VPN endpoint can correctly route, log, and authenticate traffic---making secure connectivity between private networks work as intended. Without it, your VPN will likely fail or behave unpredictably.