0

I've set up a VPN with a LAN behind it. VPN : 10.2.1.X LAN : 192.168.1.X

When I connect from outside where the router via DHCP assigns me a similar IP to my "original LAN" (192.168.1.X) everything starts to be messed up. I can't route my traffic through the VPN and (obviosly) I can't reach my "real" LAN behind my VPN. How can I always reach my LAN? I thought that I can fake my LAN subnet to something like "10.2.2.X" to those PCs out of my VPN but in this way my VPN server should translate 10.2.2.X to 192.168.1.X (locally).[Is this S/D-NAT?] Is this possible? How can I accomplish that?

Thank you very much!

Improve this question
4
  • >DHCP assigns me a similar IP to my "original LAN" (192.168.1.X) and why do you do that? It is best to assign to vpn clients ip address from another subnet. For example 10.2.2.0/24 or 192.168.2.0/24 >How can I always reach my LAN? what vpn server do you use? And what OS? Do you use dns or just ip address to access LAN services?
    – ALex_hha
    Jul 3, 2013 at 12:13
  • Sadly I can't change my LAN subnet. I use OpenVPN running on a Raspberry Pi with Arch Linux. I'm using IPTABLES to do the internet routing with a masquerading rule.
    – peperunas
    Jul 3, 2013 at 13:35
  • You don't need to change LAN subnet, only VPN. As I know openvpn can push routes to the clients. So assume that your LAN subnet 192.168.1.0/24 and vpn subnet 192.168.2.0/24. All you need is to push route to 192.168.1.0/24 via 192.168.2.1. Do you use road warrior setup of openvpn?
    – ALex_hha
    Jul 3, 2013 at 14:26
  • My problem is that I need to reach the LAN behind my VPN (from now on I'll call it LANVPN). My LANVPN has 192.168.1.X addresses. If I push the 192.168.1.X route to a connection where my IP is on the same subnet (192.168.1.X), caos begins.
    – peperunas
    Jul 3, 2013 at 20:07

1 Answer 1

Reset to default
0

If your client LAN and the destination LAN are using the same network addresses, you're in trouble. It can be overcome with some bi-directional NAT, but it's a very ugly hack.

A much easier solution would be to use different networks on each end of the VPN. Change one or the other, it doesn't matter.

Improve this answer
3
  • Sadly, I can't modify any networks. :-(
    – peperunas
    Jul 3, 2013 at 20:08
  • See option #3 ("Dirty NAT") - nimlabs.org/dirtynat.html
    – Jim G.
    Jul 3, 2013 at 20:10
  • That should do the "trick"! Thank you very much!
    – peperunas
    Jul 3, 2013 at 20:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .