I have 2 sites connected with LAN-LAN VPN - all works fine for traffic between sites.

I need to forward Internet traffic (ports 80/443/25 etc) from WAN interface on site A to a server on site B

As per Draytek article I simply set Port Forward to the IP address of the server on site B - but it doesn't seem to work.

Looking at the logs on Site A router I see entries for the Virtual Server connections from the WAN to the IP address on Site B but monitoring the LAN on site B with tcpdump shows no packets arriving. Connections simply tine out.

I've tried PPTP, IPSEC, GRE over IPSEC and L2TP for the WAN-WAN VPN all of which work perfectly between the site subnets, but no luck at all with the Port Forward traffic ...

Given that this functionality is described in a Draytek article, and the router is happy to accept a remote LAN IP address in the Port Forward screen I can only assume that its meant to work, and I'm just missing something .... I've also tried Open Ports, and DMZ setups on site A's router with the same results.

I'm more than a little puzzled at this point ...

Chris...

Do you have a link to the Draytek article?

I have a 2860->2830 L2TP/IPSec VPN, so I thought I'd try a little experiment. When I logged onto the (remote) 2830n, I realised I'd tried this before (and failed).

I can send data out from the 2860n over the VPN (I do so for SMTP, as the 2830n end has a fixed IP). Like you, I can't get it come in via that route though :?

Draytek FAQ about port forwarding over the VPN ...
https://www.draytek.com/en/faq/faq-vpn/vpn.others/how-to-do-port-redirection-to-a-host-on-the-remote-network/

Ta, I'll read it in a bit.

OK - so there's nothing earth-shattering in that document...
...and it definitely doesn't work for the 2830n.

I tried adding some Route Policy entries - but they didn't do anything (and the 2830n doesn't have a 'Diagnose' option).

I also tried some "syslogging" Firewall rules - but couldn't get any of them to trigger.

A bit of a puzzle - which is about where I got to when I first tried it - and then forgot all about it

Glad I'm not the only one feeling puzzled ... And thanks for your help

I'm pretty sure it's not an issue restricted to a particular model as I have also tried a 2820 and 2850 at either end ...

What I really need to know is if anyone else has this working, or a definitive answer that it should, then I won't give up trying ..

It's quite key to me as it's required as part of a circuit resilience strategy to get around 4G telco restrictions on incoming connections.

Chris