1

I have two different networks:

  1. Home network 192.168.1.0/24
    A - Home PC (192.168.1.100)
    B - Home Router (192.168.1.1 lan ip - x.x.x.x public ip)
  2. Office network 192.168.1.0/24
    C - File Server (192.168.1.200)
    D - Office Router (192.168.1.1 lan ip - x.x.x.x public ip)

Both networks have same ip rage and cannot be changed.
I set up pptp server in D (Office Router).

I set up pptp client in A (Home PC), getting a second ip for tunnel 172.19.0.1

I want to access from A (192.168.1.100) to C (192.168.1.200) but i only can reach D because of the same ip range.

I want to masquerade or remap network 2 so i can access from A (192.168.1.100) to C (172.19.0.200) thus D router could translate ip 172.19.0.200 to 192.168.1.200.

Router D is linux based so the solution think must me set up with iptables.

Anyone could help or give a clue about how to configure this?

2
  • "Both networks have same ip rage and cannot be changed." This is your home network. It can be changed. Re-numbering one of the networks is the right way to do this.
    – EEAA
    Mar 31, 2014 at 16:43
  • I can not change any of those two networks. Office network cannot be changed because of licences and configs issues and regarding home network, i could change it but i cannot control the networks where my clients are. Very often in spain the default network at home is 192.168.1.0/24 and ISP is who configures it by default. So the main goal for this is to get VPN config that resolve this situations.
    – Abraham
    Apr 10, 2014 at 8:47

2 Answers 2

0

It is generally accepted that you can not form a VPN tunnel between two sites with the same network range for good reason. However, some notes and suggestions to help you along your way:

Did you typo your public IPs? 192.168.0.0/16 are private, non-routable IPs. If those are indeed the public IPs of each of your routers, then your routers are not edge devices and additional configurations will need to be made on your edge routers (possibly your modems) to forward the appropriate traffic to your routers. Your routers may also need to be able to support NAT-T with this configurations as well.

Aside from that, if I understand what you have setup so far:

Client A --(vpn)-- Router D -- Server C

Client A: 172.19.0.1/24 Router D external: ?? (see note above) Router D internal: ?? (see note above) Server C: 172.19.0.200/24 (desired)

I could see connectivity being achieved by installing a second network card into your server (assuming it doesn't already have an extra one) and setting that card up as 172.19.0.200/24, this would require you to be able to add a second network onto Router D (your criteria was that the 192.168.1.0 network would remain unchanged). Server C routing table would need to reflect that traffic destined for the 172.19.0.0/24 network should be going out that second card with the router's IP on the second network being the gateway.

It is not the cleanest solution, its really just avoids the same-network issue by creating a second network and putting the server on both networks at the same time, but it should work. You would definitely want to look into device limitations before allocating serious amount of time or funds.

EDIT Regarding OP's comment. Typically speaking, you cannot NAT incoming VPN traffic because it is still encrypted at the point of the router's firewall. VPNs work because their traffic has NONAT specified in the VPN traffic selectors. Unless your office router hardware is unique in this respect and that you can perform NAT past the firewall, then I do not believe what you want to do is possible. I apologize that I am unable to assist further.

Good luck :)

5
  • Hi. I have edited my question to make it more clear. I meant that each router has one internal lan ip (192.168.1.1) and one external public ip (x.x.x.x) no matter what is it for this purpose. I dont need one extra card and cannot have it because the router is hardware and cannot be modified, but i could configure a new virtual ethernet port. But this is not the solution. Thanks for your help, but i need someone to tell me the iptables config in order to NAT one network to another.
    – Abraham
    Mar 31, 2014 at 19:10
  • My router is linux so this could be possible, dont know how difficult will be but i´m sure it can be done. Comercial software Hamachi from log me in works this way. They make access possible no matter if you are on different or same network address. They masquerade all entire destination network so ca be accessible as another one as i exposed before.
    – Abraham
    Apr 10, 2014 at 8:50
  • Hamachi is using a lot of hardware and software that you do not have. So Hamachi is not really a good example of it being possible. Also, in effect does the same thing I said. It gives you a completely different set of IPs to work with. Hamachi is software based, you are trying to do this with hardware, two completely different things. I could write software that sets up a VPN tunnel between two hosts with no real problem, not so much with a router.
    – MartinC
    Apr 10, 2014 at 13:05
  • Maybe i didn´t explain clear enought. My router is software, linux based. I can configure vlan, iptables, routing .... DDWRT, Tomato, openwrt, are fully configurable for this. Anyway this is not the point, i could change if neccesay vpn server from router to centos, ubuntu, suse or whatever linux server. The point is that i need to configure with iptables, routing, vpn configs, etc the tunnnel as i told before.
    – Abraham
    Apr 11, 2014 at 14:00
  • I don't think you understand what I said. Your router is hardware, It doesn't matter what software that your HARDWARE router is running. You would need software that sits and runs on each device that you want connected. Routers are not capable of everything that software is, and vice-versa.
    – MartinC
    Apr 11, 2014 at 17:12
0

I finally found a way to solve the problem. It is necesary to configure iptables in order to NAT the entire network. This is made by NETMAP option, so we need to run:

iptables -v -t nat -A PREROUTING -d 192.168.1.0/24 -j NETMAP --to 172.19.0.0/24

No special hardware at all. If the router is linux based, you can use iptables. For other systems check the equivalent to netmap.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .