I set up a xl2tpd vpn server on a router, and assigned the ip range from to, and there's local network behind the router's lan side with a ip range, so I want the vpn client access the router from its wan port, then it can communicate with the local network, so how can I got it? I wonder to known how to set up the route rules to make it up, so any tips?


Is you setup like this?

 [                  ] the ISP router is your WAN gateway access to the internet, and 
 [your ISP's router!] provide your WAN area of, say, A.B.C.D/28 (for example)
 [                  ] 
   | the isp's router ip in your wan network is, for example, 
   | A.B.C.E, which is the default gateway you need to setup in your router!
   |  {your router wan ip: A.B.C.D/18}
    `-[      ]...{serves all vpn guests in 192.168.191.x/24}
      [      ]-. {your router LAN ip :} 
               |    [LAN's switch] (for all 192.168.0.x/24 hosts, including router's LAN port)
               |     | |  |  |
                `----' |  |   `-- other 192.168.0.y/24 host
                       |   `-- other 192.168.0.z/24 host
                        `-- etc...

Then your router already knows about : the LAN, the vpn guests, and the internet. On it, no special routes should be added: it should already have one for the LAN, one for the guests, and the default one for Internet. It can send packets: to 192.168.191.X/24 (via his ip in that virtual lan), and to 192.168.1.x/24 (via his other IP in that real LAN), and send everything else to its wan default gateway (provided to you by your ISP. If your have, say, a /28 lan, then the router WAN ip is a.b.c.d/28 and the ISP also gave you the default gateway as a.b.c.E, another ip in that a.b.c.d/28 range where their own router resides.

Now the LAN pcs: they should have their default gateway set to the ROUTER's LAN ip. Then no special route needed for them either : they will do "oh, a packet destined for 192.168.191.x, when my LAN is 192.168.0.x/24 ? not in my LAN, and no special route for this network, so I send it to my default gateway (ie, the router) to be handled there"

Now the VPN Guests: should be already served a 192.168.191.x ip and have as default gateway the ROUTER's IP, so no special route needed for them either! (a packet destined for 192.168.1.x will, with no special routes setup, be sent to the dfefault gateway, the router, who happens to know how to handle them to destination)

So, nothing to do. If you need routes, it's probably because you have a different setup than the above (maybe you have special needs, or additionnal networks to reach via a specific gateway/router), or that some basic thing weren't setup properly during the above networks and IP configs declarations.

  • additionnaly, on your router, wou probably can (and should) define who can access what, and how: can your VPN guest access things on your LAN? and the opposite? can they access each other? each time, define what they really need to have, do not give out a "everything" rule, too easy for hackers to take advantage of. Decide what they really need to do wich each other: icmp ping? ssh? (ssh also gives sftp and scp) rdp? other? – Olivier Dulac Dec 31 '12 at 11:22

You are defeating the purpose of vpn's. The remote lan should not communicate with local lan.

However you can tweak it.

Design for the same subnet throughout and exclude host you do not want to expose from NAT.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.