I have built my own router on a machine with 2 NICs, running Debian. The machine sees my public IP address on one side, and the internal network ( on the other. I am trying to set up implementations of all major VPN protocols, to access my network from road warriors.

I found that with OpenVPN in TUN mode, it is necessary to use a different subnet range for the connected clients (e.g. If I try to use the same subnet as my own internal network (42), the packets do not route, and cannot ping machines inside the network from the client connected via VPN. By configuring a different subnet, and pushing a route, I can.

Alternatively (still with OpenVPN), I use TAP mode and configure bridging, I can configure the clients to use the same internal network subnet (42), and the clients behave truly as if they belong to the internal network, and can ping machines inside the network.

For other VPN implementations (e.g. PPTP and L2TP), I have read many HowTos, but they are not clear about whether it is necessary to use a different subnet for the VPN client endpoints.

My primary question is, do these servers (based on Debian implementations pptpd and xl2tpd) require the use of a separate subnet for VPN clients?

I have also seen a separate subnet used for the tunnel itself (often illustrated in the 10.x.y.z range), so in the end there are 3 subnets! My secondary question is, is this tunnel subnet required for it to work? I don't see the benefit there.

(I have PPTP working on the same subnet, but without broadcasts, and its a bit flaky. I can't get L2TP over IPSEC working on the public IP, only on an internal machine behind NAT for some reason - separate issue!)

Thanks, Dave


It depends whether the VPN provides routing or bridging. Routing requires a separate subnet for VPN clients. This is the most common configuration, and the one you want to use (unless there's a specific reason you can't).

  • Many thanks for your answer. I prefer to implement a bridging solution, because some software I'm using uses broadcasts. The reason for the question is that I can't get L2TP over IPSEC (openswan) working, and I'm not sure if the IP range in the L2TP server configuration is supposed to be in a different subnet or not? Thanks. – David Lomax Mar 12 '13 at 23:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.