I am looking to create redundant IpSec VPN Tunnels between two sites. I already have one VPN operational but due to overlapping LAN IP ranges I cannot have more VPNs active at the same time for automatic failover.

Site 1: Draytek 3900 with two WANs. This site has redundant hardware so has another Draytek 3900 ready as hot-standby to takeover the two WAN connections. This network is running on

Site 2: Cloud network. Two pfSense routers have been exposed from different datacenters which have different external IPs. Internally, using CARP and a virtual IP, all traffic uses these routers with automatic failover already. This already works and internal routing between datacenters has already been established by the cloud provider. The IP range of these devices is


Site 1 and 2 need to talk to each other, so a LAN to LAN VPN has been established between the primary pfSense Router and the primary WAN interface of the on-site Draytek. However when WAN1 at the local site or the primary pfSense router goes offline this link is lost.


Ideally, I would like 4 active VPNs all ready to go in case of any point of failure and not one. This would be:

  1. Master pfSense to WAN1 on DrayTek (Established already)
  2. Master pfSense to WAN2 on DrayTek
  3. Backup pfSense to WAN1 on DrayTek
  4. Backup pfSense to WAN2 on DrayTek

However when I setup any of the IpSec tunnels for connections 2,3 and 4 above they can't all be active at the same time because the LAN network addresses are the same.

From a routing perspective when these links are active: Draytek WAN1 > WAN2 as WAN2 is significantly slower (5MB leased line vs 100MB on WAN1).

Network overview

Virtual WAN Failover IPs for the cloud network are not available.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.