Client access cross location through VPN tunnel

Question

So here is what I would like to do, but I feel like I'm missing something

2 Locations (A,B) connected via VPN Tunnel

Outside clients should not know that location B exists but just connect to all resources as if local to location A, should a resource be located at B than the traffic should be routed via A - VPN -> B

The clients don't have to know about the VPN right? Why should they? The clients can access everything if behind VPN or local at A?

What I feel like I'm missing is the following: How do I have to setup the routes at A so the routing works? Because the traffic should be routed through the VPN if necessary but not always of course, and since the IPs of the VPN and the local Network should be in the same IP subnet I don't get my head around the routes in that case.

Thanks, I don't really know what to look for, so any pointers are helpful

Extending on the Scenario, which this might be useful and is kind of what I want to do: Relocation of a Server to a 2. Site temporarily without having to update any hardcoded IPs or anything like that. The Server or maybe Servers are supposed to keep their IP under which they are reachable, just now they are reachable via VPN Tunnel to the 2. Site but Clients don't have to know that.

I Guess that means a Roadwarrior setup for any Servers relocated.

Answer 1

You're likely to run into two issues. The first one you mentioned is routing. The second which you didn't mention is name resolution.

You didn't mention what sort of VPN tunnel you have setup so I'll assume you have two edge devices (routers/Firewalls/UTMs) that are doing the VPN tunnel which are also the local LAN's gateway. If it's not your gateway device then you will need to setup the routes on the gateway to route back to the internal IP address. This is common if you have a device inside your network that is the VPN end point like with OpenVPN or a Windows Server that's inside a firewall.

First some quick definitions of the Lans so that we have some real IP addresses and routes to use as an example.

Site A
Subnet: 10.10.0.0/24
Gateway: 10.10.0.1

Site B
Subnet: 10.10.10.0/24
Gateway: 10.10.10.1

Both sites default route should be it's local internet connection. Then each site needs a route to each others subnet.

So the router at Site A should have a route to 10.10.10.0/24 set to go out the VPN tunnel. Likewise the router at Site B should have a route to 10.10.0.0/24 set to go through the VPN tunnel. Depending on the hardware involved how you do this may differ. For instance with our Fortigate hardware you have to also setup a firewall rule to encrypt the traffic. Where my snapgear stuff setups up the routes as part of the IPSEC configuration.

But once you have that setup you should be able to ping computers on either side of the tunnel. As long as they don't have firewall rules that restricts them from responding to any traffic not originating from their local subnet.

So to get the name resolution working you may need to setup some WINS servers or do some DNS related things to get the names to resolve across the different subnets.

I don't know if this will get you to your end goal of setting this up but it should get you pointed in the right direction.