Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If the network of someone's home network (Say 192.168.1.1/24) and the network that they vpn into has that same range in it, how can that be handled? I don't mean when the VPN hands out an IP in the same range, but just when that I exists on the network.

I figure it would have to be handled on the client side. But is there a to configure common vpn clients so maybe only the IP of machine itself, and its gateway remain local, and all other requests go over the VPN?

...It seems like it could be possible, maybe by mangling the arp table somehow....

share|improve this question

1 Answer 1

up vote 3 down vote accepted

It depends on your routing table, but in general, your local network will override everything.

Your routing table says "these hosts on this network, goes out through this interface using this gateway (or not using a gateway at all)"

By default your LAN network will have routes for 192.168.1.0/24[1]. Taking into account, your default gateway is also more than likely on this network (e.g. 192.168.1.1), if your VPN routes overwrote these routes you'd lose connectivity to your default gateway.

However, you can do one of two things to make it potentially "workable", but it requires manually editing your routing table.

  1. Enter in specific static host routes for machines you need access to on your local network. (i.e. route add) and use the more generic network route for your VPN. Obviously, you should need at least need a default gateway route to get access to your VPN.

  2. Enter in specific static routes for machines on the foreign VPN network and leave the generic network route for machines on the local LAN.

2 is the more common scenario I've seen in situations where there is a conflict. Of course, you're better off not choosing 192.168/16 for any office network or VPN because of the proliferation of that on home network devices.

[1] As an aside it's more appropiate to use the network number when using CIDR as opposed to a host.

share|improve this answer
    
Oh right, because the more specific route will take precedence! –  Kyle Brandt Nov 10 '09 at 20:54
1  
I've also seen some home routers that use 10.0.0/24 or 10.1.0/24 by default. That's one reason we set up our office network to use 10.2.x.x and onward. –  Kamil Kisiel Nov 10 '09 at 20:59
    
My preference (to avoid 10/24 and 192.168/16 conflicts) is to use 172.16/20 for an internal office network. –  Philip Reynolds Nov 10 '09 at 21:09
    
Note that ultimately if your home LAN shares address space with the VPN, you'll quite possibly run in to problems no matter what... what happens when your home router is at (say) 192.168.1.1 and you have a VPN'd server to access at the same IP? You can't. One possible workaround to all of this, though, is to VNC or RDP over to a workstation/server within the VPN'd range, and work from there. Then you only need access to one IP from the VPN, not all of them. –  mibus Nov 10 '09 at 23:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.