2

I have my topology as follows ...

----------------------
|                    |
|     LAN-1          |
| (192.168.2.0/24)   |
|                    |
|                    |
|                    |
---------------------|               
|     INTERNET       | 
|                    |
|                    |
|                    |
|                    |
---------------------- 
|     LAN-2          |
|  (192.168.2.0/24)  |
|                    |
|                    |
|                    |
|                    |
----------------------

Here from the above diagram we can observe 2 LANS are connected to INTERNET.

1) LAN-1 is having the network 192.168.2.0/24

2) LAN-2 is having the same network as LAN-1 192.168.2.0/24

My Requirement

My requirement is i want to access the deivces from LAN-1 to LAN-2 by using VPN .

For Example

I want to ping 192.168.2.4 from LAN-1 to 192.168.2.10 which is in LAN-2 . But the ping is always going to my own network as my own network is havnig the destination network . How can i overcome this situation .

Note :

I know  , I should always make sure that 2 LANS should be configured with different subnets .


I don't want to do that , 

Any solution for this ?
Improve this question
4
  • What VPN equipment are you using?
    – Brett Lykins
    Sep 26, 2013 at 13:12
  • It can be any VPN . Let us assume want to access through VPN .I want to bypass my network . that is my target. Is this possibe ?
    – user2720323
    Sep 26, 2013 at 13:13
  • inside the same building, between buildings on the same campus, or between cities? Is it safe to assume no firewall blocking the vpn traffic? Are service provider vpns acceptable?
    – Mike Pennington
    Sep 26, 2013 at 13:39
  • It is between 2 different cities . Assume no firewall is blocking the VPN traffic
    – user2720323
    Sep 26, 2013 at 13:54

5 Answers 5

Reset to default
5

Renumbering is the right answer. If you don't want to do that, then implement NAT in both directions. This would allow you to keep the existing IPs in both locations. However, each side would "look" like a different subnet from the other side.

Improve this answer
3
  • 1
    I'm not really sure why this has 4 upvotes - it doesn't meet the OP's requirements at all.
    – John Jensen
    Sep 29, 2013 at 0:25
  • His requirement is to access devices in LAN1 from LAN2 via the VPN. NAT meets this requirement.
    – Ryan
    Sep 30, 2013 at 13:21
  • Respectfully, his requirement is also to not have to renumber - NAT won't easily meet this and totally renumbering isn't necessarily the right answer either.
    – John Jensen
    Sep 30, 2013 at 20:02
3

NAT is an option but it's going to be complicated, and overly so.

IMO the better solution to accomplish this is with VPLS or L2TPv3. Contact your carrier to see if they can provide VPLS or other L2VPN services.

Improve this answer
2

Bridging and Proxy ARP. OpenVPN should be capable of providing this with a host on each end, probably also any Cisco with irb configured between an ethernet interface and an ipsec tunnel.

Improve this answer
2
  • 1
    You'll still need to be careful to avoid duplicate addresses -- especially for the gateway (e.g., both networks use 192.168.2.1 for a gateway, and one host on each network uses this address).
    – user8162
    Sep 26, 2013 at 17:56
  • This will also mean that each network will have to have a different gateway such that traffic local to one site will not be sent to the other site. This is not an issue if only one subnet is there at each site.
    – AdnanG
    Sep 30, 2013 at 10:08
1

You will need double NATing to achieve this without changing IP addresses. You can not ping an IP that is in your LAN and expect it to reach somewhere else. As long as you are part of a LAN and communicate locally, your traffic to IP address in 192.168.2.0/24 will always go to your local network. As mentioned above, you will need two IP ranges lets say 192.168.102.0/24 and 192.168.202 that will be used for double NATing like this:

  1. LAN1 (source:192.168.2.100, destination:192.168.202.100) ------->

  2. LAN1 Gateway Router which will do NATing and VPN. (change source:192.168.102.100,destination:192.168.202.100) --------------->

  3. LAN2 Gateway Router which will terminate VPN and do NATing (source:192.168.102.100,change destination:192.168.2.100) ------------------------------------------------------>

  4. Packet reaches LAN2.

The return path will work similarly:

  1. LAN2 (source:192.168.2.100, destination:192.168.102.100) ------>

  2. LAN2 Gateway Router which will do NATing and VPN. (change source:192.168.202.100,destination:192.168.102.100) -------------->

  3. LAN1 Gateway Router which will terminate VPN and do NATing (source:192.168.202.100,change destination:192.168.2.100) ----------------------------------------------------->

  4. Packet reaches LAN1.

As you can see, LAN1 appears to LAN2 as 192.168.102.0/24 and LAN2 appears to LAN1 as 192.168.202.0/24.

Improve this answer
-1

if you dont want to change change your addressing scheme then best possible solution is the usage of NAT

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.