Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have built my own router on a machine with 2 NICs, running Debian. The machine sees my public IP address on one side, and the internal network ( on the other. I am trying to set up implementations of all major VPN protocols, to access my network from road warriors.

I found that with OpenVPN in TUN mode, it is necessary to use a different subnet range for the connected clients (e.g. If I try to use the same subnet as my own internal network (42), the packets do not route, and cannot ping machines inside the network from the client connected via VPN. By configuring a different subnet, and pushing a route, I can.

Alternatively (still with OpenVPN), I use TAP mode and configure bridging, I can configure the clients to use the same internal network subnet (42), and the clients behave truly as if they belong to the internal network, and can ping machines inside the network.

For other VPN implementations (e.g. PPTP and L2TP), I have read many HowTos, but they are not clear about whether it is necessary to use a different subnet for the VPN client endpoints.

My primary question is, do these servers (based on Debian implementations pptpd and xl2tpd) require the use of a separate subnet for VPN clients?

I have also seen a separate subnet used for the tunnel itself (often illustrated in the 10.x.y.z range), so in the end there are 3 subnets! My secondary question is, is this tunnel subnet required for it to work? I don't see the benefit there.

(I have PPTP working on the same subnet, but without broadcasts, and its a bit flaky. I can't get L2TP over IPSEC working on the public IP, only on an internal machine behind NAT for some reason - separate issue!)

Thanks, Dave

share|improve this question

It depends whether the VPN provides routing or bridging. Routing requires a separate subnet for VPN clients. This is the most common configuration, and the one you want to use (unless there's a specific reason you can't).

share|improve this answer
Many thanks for your answer. I prefer to implement a bridging solution, because some software I'm using uses broadcasts. The reason for the question is that I can't get L2TP over IPSEC (openswan) working, and I'm not sure if the IP range in the L2TP server configuration is supposed to be in a different subnet or not? Thanks. – David Lomax Mar 12 '13 at 23:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.