Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a VPN setup for each of our three branches. I understand that each router should be on a different subnet to the router that it's connecting to, but do the routers need to be on a different subnet to each other?

As an example:

Main Practice:  1.0/24
Branch one:     2.0/24
Branch two:     3.0/24
...etc

This works perfectly and all tunnels are open simultaneously and one subnet can ping another.

I am looking into changing our IP structure (as per another of my questions on SF), and wondered if I could simplify adding VPN tunnels for new users by allowing them to keep their home network on whatever subnet its already set and simply setting up the tunnel.

The desired result would be:

Main Practice:    10.1.1.0/24
Branch one:       192.168.1.0/24
Branch two:       192.168.1.0/24
...etc. 

The branches are on a different subnet to the main practice, so would this work?

share|improve this question
add comment

1 Answer

To do what you're describing you would have to use some kind of NAT to "hide" the 192.168.1.0/24 subnets from the main practice. You would assign a /30 or something to the VPN, and then NAT all traffic from the branch to use an address on the /30 as a source IP.

Honestly, though, this is asking for trouble. It's going to be a lot clearer in the long run just to use different IP ranges at every branch.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.