Routing to 3rd party website via site to site VPN.

[JasonNgAcuutech]

Hi,

I'm having an issue accessing a website in China. I believe it is an issue with the ISP. I am trying to come up with a temporary workaround.

Currently, I have a site-to-site VPN that is connected to a Singapore office, which is Meraki MX configured as Non-Meraki VPN peers.

The workaround I want to achieve is for this website to be routed through the site-to-site VPN via the Singapore office.

Under static route, I don't see an option where I can select the next hop as "Singapore VPN gateway"

Any advice will be greatly appreciated.

[ww]

You have to add the website ip to the subnets in your vpn settings

https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-Site_VPN_Settings#Non-Meraki_VPN_Peers

[JasonNgAcuutech]

Hi,

Forget to mention, in the China network, I added the Public IP in under the "Private subnets" under the Non-Meraki VPN peers to Singapore and can see it reflecting under the Route table.

However, it is still not working.

[ww]

Does the other side have routes back to your source subnet from where you try to access it from

[JasonNgAcuutech]

Yes. The LAN IP are working between the S2S VPN.

[PhilipDAth]

If you want to do it only for a single site you'll need to deploy something like HA Proxy in Singapore.  You can use a config like this:

frontend https-frontend
        mode tcp
        bind *:443
        default_backend https-backend

backend https-backend
        mode tcp
        balance source
        server website a.b.c.d:443 check check-ssl verify none

Where a.b.c.d is the public IP address that the website resolves to.

Then create an entry in AD DNS for the exact website FQDN pointing to the private IP address of the HA Proxy server.

[JasonNgAcuutech]

Thanks for the suggestion.

However, we would like to minimise the workaround without deploying more solutions to the infra.