Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a VPN setup for each of our three branches. I understand that each router should be on a different subnet to the router that it's connecting to, but do the routers need to be on a different subnet to each other?

As an example:

Main Practice:  1.0/24
Branch one:     2.0/24
Branch two:     3.0/24

This works perfectly and all tunnels are open simultaneously and one subnet can ping another.

I am looking into changing our IP structure (as per another of my questions on SF), and wondered if I could simplify adding VPN tunnels for new users by allowing them to keep their home network on whatever subnet its already set and simply setting up the tunnel.

The desired result would be:

Main Practice:
Branch one:
Branch two:

The branches are on a different subnet to the main practice, so would this work?

share|improve this question

To do what you're describing you would have to use some kind of NAT to "hide" the subnets from the main practice. You would assign a /30 or something to the VPN, and then NAT all traffic from the branch to use an address on the /30 as a source IP.

Honestly, though, this is asking for trouble. It's going to be a lot clearer in the long run just to use different IP ranges at every branch.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.