Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was following this tutorial http://wiki.debian.org/OpenVPN#TLS-enabled_VPN and this one http://users.telenet.be/mydotcom/howto/linux/openvpn.htm to create openvpn connection to my remote LAN.

But both examples assumed that both LANs have different addresses (ie 192.168.10.0/24 and 192.168.20.0/24, check out this image i.stack.imgur.com/2eUSm.png).

Unfortunately in my case both local and remote lan have 192.168.1.0/24 addresses. I am able to connect directly on the openvpn server (I can ping it and log in with ssh), but I can't see other devices on the remote LAN (not mentioning accessing them via browser which was the point from the first place). And don't know if the addressing issue may be the reason of that? If not - how to define routes, so I could ping other devices in remote LAN?

share|improve this question
1  
I should maybe mention that openvpn server is behind publicly available router, which has forwarded port 22 to local 192.168.1.3:22 and the same way 1194 port for openvpn –  meta Oct 11 '12 at 23:13
add comment

2 Answers

up vote 2 down vote accepted

You're sunk. All the machines are using the same subnet. How do you propose they would be able to distinguish local from remote hosts? Your only option here would perhaps be some form or port forwarding from the VPN hosts at each site. This would work for a few services, but would be a nightmare to support long term.

You really just need to bite the bullet and re-number one of the sites.

My guess is that you don't have a good grasp on some core networking fundamentals. I'd highly recommend you read though this Serverfault Q&A on IPv4 subnetting. That will help you better understand the why behind your present difficulties.

share|improve this answer
    
Thank You Eric for confirming my guess. And yes, your guess is correct as well, I have some stuff to get my head around regarding networking. I will definitely read what you suggest. –  meta Oct 12 '12 at 5:41
    
ps. I just got the idea. My local network is somehow defined by router I'm "behind" - I would not always have power to re number it. Is there a way to hide myself behind some kind of "virtual router" so I'm in the "local-local" network I can control? I work on ubuntu linux so I guess this should be possible but what should I google? –  meta Oct 12 '12 at 6:04
1  
Sorry, with your current state of networking knowledge, you have no business trying to do anything complex or unorthodox. Get your head around the basics and then the solution (which is re-numbering) will become self evident. –  EEAA Oct 12 '12 at 14:47
    
Oh, come on. You don't need to be overprotective. Let's say I can not re-number any of those networks. Just give me a hint what to look for and I will bang my head through this wall. I promise I will not hurt myself in case of failing ;) –  meta Oct 12 '12 at 18:50
1  
I'm not being overprotective. I'm being realistic. What you propose is impossible. Read about how routing works. –  EEAA Oct 12 '12 at 20:57
show 1 more comment

Even if this question is already answered, here is another option:

  • Assign a secondary IP in a free subnet to the gateway on one side
  • Use the NETMAP target in iptables to translate everything

If you choose 192.168.2.0/24 as alternative subnet on one side, you could use this rule to translate the Network:

iptables -t NAT -A POSTROUTING -o tap0 -j NETMAP --to 192.168.2.0/24
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.