Setting up FVS318 to FVS318 VPN tunnel behind another router


Got a simple question regarding setting VPN tunnels between two FVS318s Netgear VPN firewall routers.

I will be setting up two FVS318 routers via a VPN tunnel to one another.  I have done it numerous times successfully, providing both FVS318s have a public IP address and all (DMZ) ports available to it.  

In this case, one of the FVS318s will be behind another NAT 3rd party router (router B) issuing it an internal (192.X.X.X) address.  

I just need to know which port(s) must be forwarded on router B in order for the two FVS318's to communicate.   I have done this before in the past, and I am sure its 1 TCP port (maybe TCP 1723?).  Can anyone confirm?
Who is Participating?
dpk_walConnect With a Mentor Commented:
As you wish to have site-site IPSec VPN tunnel between two routers, you need to open following ports on router B:

UDP 500 -- For IKE
UDP 4500 -- For NAT-T
Protocol 50/51 --- Please note these are not port numbers but protocol numbers for ESP/AH
                             (respectively); these are not TCP or UDP but IP protocol numbers.

Please note you need to open UDP4500 only if routerB support NAT-T; which I think you would need to use as one of the FVS router is behind NAT device.

Thank you.
Rob WilliamsCommented:
Perhaps there are other methods, but I have only ever seen this work if the Netgear/VPN router is placed in the DMZ zone.
All Courses

From novice to tech pro — start learning today.