Port forwarding from MX1 to device behind MX2 (same organization, Auto VPN)

[jOMeraki2]

I have two MX devices (MX1 and MX2) in the same organization connected via Auto VPN.
MX1 is configured as the default route (exit hub) for MX2.

I’d like to know if it’s possible to create a port forwarding rule on MX1 that forwards traffic to a device located behind MX2.

Example setup:

MX1 (main site, default route)

MX2 (branch site, connected via Auto VPN)

I want to forward a specific port from MX1’s public IP to a private IP behind MX2.

Is this supported, or should the port forwarding be configured only on MX2’s WAN directly?
Any best practices or workarounds would be appreciated.

[jimmyt234]

Solved: Port Forwarding to Device on Site via Site-to-Site VPN - The Meraki Community

Is this any different to the time you asked previously?

[jOMeraki2]

Yes, it is different. In this case, I am dealing with two devices within the same organization, and they are connected via Auto VPN, unlike the previous instance.

[jimmyt234]

Fair enough - my apologies 😊

[MarcP]

As far as I know, port forwarding does not work through auto-vpn.

At least in the past, when I tried it - long time ago.

Maybe you got a public IP/dyndns on MX2 site and you can configure it like this.

[ConnorL · Accepted solution]

Unfortunately no, the MX only supports configuring a port-forward to a locally configured VLAN, you cannot configure a port forward for an AutoVPN destination, you'll get the following error:

Invalid port forwarding rule: The IP address 172.20.10.10 is not on a configured subnet.