I have built my own router on a machine with 2 NICs, running Debian. The machine sees my public IP address on one side, and the internal network (192.168.42.0/24) on the other. I am trying to set up implementations of all major VPN protocols, to access my network from road warriors.
I found that with OpenVPN in TUN mode, it is necessary to use a different subnet range for the connected clients (e.g. 192.168.77.0/24). If I try to use the same subnet as my own internal network (42), the packets do not route, and cannot ping machines inside the network from the client connected via VPN. By configuring a different subnet, and pushing a route, I can.
Alternatively (still with OpenVPN), I use TAP mode and configure bridging, I can configure the clients to use the same internal network subnet (42), and the clients behave truly as if they belong to the internal network, and can ping machines inside the network.
For other VPN implementations (e.g. PPTP and L2TP), I have read many HowTos, but they are not clear about whether it is necessary to use a different subnet for the VPN client endpoints.
My primary question is, do these servers (based on Debian implementations pptpd and xl2tpd) require the use of a separate subnet for VPN clients?
I have also seen a separate subnet used for the tunnel itself (often illustrated in the 10.x.y.z range), so in the end there are 3 subnets! My secondary question is, is this tunnel subnet required for it to work? I don't see the benefit there.
(I have PPTP working on the same subnet, but without broadcasts, and its a bit flaky. I can't get L2TP over IPSEC working on the public IP, only on an internal machine behind NAT for some reason - separate issue!)