1

I've recently setup my StrongSwan VPN, mostly following this DigitalOcean guide. It worked nicely until I encountered this weird routing issue.

Network diagram below:

+-----------+   +-----------+ Internet +------------+   +-------------+
|VPN server |___|Router     |. . . . . |WiFi gateway|___|Laptop       |
|192.168.0.2|   |192.168.0.1|          |192.168.0.1 |   |192.168.0.111|
+-----------+   +-----------+          +------------+   +-------------+

Basically I'm loosing access to my LAN when I'm connecting to a Wi-Fi that has the same IP address (or same network) as my router. When I try to connect to 192.168.0.XXX my laptop tries to access a host behind the Wi-Fi router network, rather than the VPN server's network.

I'm suspecing it's a routing issue on the client, but there's not much I can do when I connect from iOS for example.

Is there a server setting that can prevent this behaviour?

2

In terms of routing, if you are already on subnet 192.168.0.0/24 then you will access it on your local connection and not route anywhere. What you would normally exeoct is a VPN Server on a public IP address, supporting access to a private network behind it.

By setting up the tunnel through the VPN server you effectively give yourself an adapter on that network - through the tunnel.

If both networks use the same network range then your system can't tell what machines are where, and will normally identify the local connection as having a lower cost to the remote connection and so send all network traffic locally.

How can you solve this?

It may be possible to setup a client that can remap addresses for you.

However you will probably find it easier to do this at the server. Setup a second tunnel on the VPN server accessing a different private network range. Then define an adapter on the server using that range (depending on your setup that may be easy). You can remap IP Addresses using IPTABLES for example, but you will probably also need to remap ARP which is a bit tricker. You can use arptables (often used in load balancer environments).

All of this is going to be quite a lot of work ...

| improve this answer | |
  • 1
    simplest solution is to sometimes just change either side's network or use a hotspot when you need to connect. – Brad Aug 7 '19 at 23:41
  • @Brad - yes but use of 192.168.0.0/24 is very common if you have the VPN server so you can connect rom anywhere you will get conflicts in some locations. Any address range can have this problem so any hotspot may have it. – Rob Lambden Aug 8 '19 at 6:04
  • thanks @RobLambden, that is indeed what’s happening. The solution is a bit cumbersome though, I’ll probably go with Brad suggestion to change my router’s private IP to something less common, to minimize the chances of this happening again. – mihai Aug 8 '19 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.