Hi @CarlosNET 

Thanks for posting in our business forum.

Namely, do you want to port forward a port over the VPN tunnel and expose this port to the WAN2?

We don't support such a feature if this is what you want.

  @Clive_A 

thanks for answering .

I mean I need to open a port from wan1 and forward it to LAN2 through the VPN

Hi @CarlosNET 

Thanks for posting in our business forum.

CarlosNET wrote

  @Clive_A 

thanks for answering .

I mean I need to open a port from wan1 and forward it to LAN2 through the VPN

 

Can you use the IP to illustrate this?

I think it is the same thing. But a different direction.

  @Clive_A 

I appreciate your help, I think this description is more readable
thank you

Central Office

• Model: er8411v 1.0 OC300 v1.0
• WAN1 IP: 192.168.1.2/24 (Gateway: 192.168.1.1)
• LAN1 IP: 192.168.2.1/24

Branch Office

• Model: ER706W v1.0 OC200 v1.0
• WAN2 IP: 192.168.3.2/24 (Gateway: 192.168.3.1)
• LAN2 IP: 192.168.4.1/24
• IP Camera Server: 192.168.4.10/24 (SSH Control Port: 66)

External Client: An external client (without VPN) accesses the camera (IP 192.168.4.10/24, port 66) through port 555. The connection is established through the er4811, then through VPN to the er706w, and finally to the camera. The er706w cannot allow direct client connections due to CG-NAT, so a reverse NAT must be performed from the er8411 through the VPN to the er706w.

Objective: Allow access to port 555 on the er8411 through the VPN to the er706w, and have the er706w redirect the connection to the IP camera server.

Hi @CarlosNET 

Thanks for posting in our business forum.

CarlosNET wrote

  @Clive_A 

I appreciate your help, I think this description is more readable
thank you

Central Office

• Model: er8411v 1.0 OC300 v1.0
• WAN1 IP: 192.168.1.2/24 (Gateway: 192.168.1.1)
• LAN1 IP: 192.168.2.1/24

Branch Office

• Model: ER706W v1.0 OC200 v1.0
• WAN2 IP: 192.168.3.2/24 (Gateway: 192.168.3.1)
• LAN2 IP: 192.168.4.1/24
• IP Camera Server: 192.168.4.10/24 (SSH Control Port: 66)

External Client: An external client (without VPN) accesses the camera (IP 192.168.4.10/24, port 66) through port 555. The connection is established through the er4811, then through VPN to the er706w, and finally to the camera. The er706w cannot allow direct client connections due to CG-NAT, so a reverse NAT must be performed from the er8411 through the VPN to the er706w.

Objective: Allow access to port 555 on the er8411 through the VPN to the er706w, and have the er706w redirect the connection to the IP camera server.

 

VPN Client---VPN tunnel---ER8411(which is a VPN server)---VPN tunnel---ER706W_LAN---IPC server.

Is this what you mean?

You want a client to access the IPC?

That's possible as long as the VPN is established. However, the VPN client is required to access the IPC server LAN IP and local port. This is the only way you can do with our products now.
 

We don't support you change the port to 555 on the ER8411 and IPC IP to a different one. It should be a LAN > LAN VPN implementation. Something similar to this: How to Configure WireGuard to Enable Client to Access Remote IPsec Site