So here is what I would like to do, but I feel like I'm missing something

2 Locations (A,B) connected via VPN Tunnel

Outside clients should not know that location B exists but just connect to all resources as if local to location A, should a resource be located at B than the traffic should be routed via A - VPN -> B

The clients don't have to know about the VPN right? Why should they? The clients can access everything if behind VPN or local at A?

What I feel like I'm missing is the following: How do I have to setup the routes at A so the routing works? Because the traffic should be routed through the VPN if necessary but not always of course, and since the IPs of the VPN and the local Network should be in the same IP subnet I don't get my head around the routes in that case.

Thanks, I don't really know what to look for, so any pointers are helpful

Extending on the Scenario, which this might be useful and is kind of what I want to do: Relocation of a Server to a 2. Site temporarily without having to update any hardcoded IPs or anything like that. The Server or maybe Servers are supposed to keep their IP under which they are reachable, just now they are reachable via VPN Tunnel to the 2. Site but Clients don't have to know that.

I Guess that means a Roadwarrior setup for any Servers relocated.


You're likely to run into two issues. The first one you mentioned is routing. The second which you didn't mention is name resolution.

You didn't mention what sort of VPN tunnel you have setup so I'll assume you have two edge devices (routers/Firewalls/UTMs) that are doing the VPN tunnel which are also the local LAN's gateway. If it's not your gateway device then you will need to setup the routes on the gateway to route back to the internal IP address. This is common if you have a device inside your network that is the VPN end point like with OpenVPN or a Windows Server that's inside a firewall.

First some quick definitions of the Lans so that we have some real IP addresses and routes to use as an example.

Site A

Site B

Both sites default route should be it's local internet connection. Then each site needs a route to each others subnet.

So the router at Site A should have a route to set to go out the VPN tunnel. Likewise the router at Site B should have a route to set to go through the VPN tunnel. Depending on the hardware involved how you do this may differ. For instance with our Fortigate hardware you have to also setup a firewall rule to encrypt the traffic. Where my snapgear stuff setups up the routes as part of the IPSEC configuration.

But once you have that setup you should be able to ping computers on either side of the tunnel. As long as they don't have firewall rules that restricts them from responding to any traffic not originating from their local subnet.

So to get the name resolution working you may need to setup some WINS servers or do some DNS related things to get the names to resolve across the different subnets.

I don't know if this will get you to your end goal of setting this up but it should get you pointed in the right direction.

  • Thanks, so far so good, DNS is not a Problem for now and will be setup later. Thinking about it is there a way to Use the same Subnet for Site A and Site B while B is connected via VPN to A? Imagine a ie Server X which is reachable via VPN at Site B, and only via VPN. So practically the Server is in the Site A Network just its physical location is B. I guess that would mean a RoadWarrior Setup for X with a static IP in Network A. Feb 1 '10 at 15:44
  • You can use the same subnet but it's best to avoid it as it adds some complexity to the setup. To do this you have to setup bi-directional nat also called double nat. This makes the other site appear to be on a different subnet. This is the one reason that most business networks avoid and as those two subnets are almost always the default subnets for consumer equipment. Feb 1 '10 at 16:20
  • In your example of a server being located at site B as long as the routes and DNS/WINS are setup correctly there's no need for the server to be in Site A's subnet. Feb 1 '10 at 16:26
  • You are right with all the DNS/WINS, but like I added to my orignial post my Idea behind the whole mess of a setup, would be to keep the server reachable under the same IP as befor, just now this is tunneled thorugh VPN. Feb 1 '10 at 16:41
  • You may be able to do that with some additional policy routes on your routers that target specific IP addresses rather than subnets. But I've never had to deal with that situation so I can't say for sure that would work. Feb 1 '10 at 17:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.