Please forgive my ignorance, but I need to set up an IPSEC site-to-site VPN between our 192.168.x.* network and a 10.y.z.* network somewhere else. I guess I need some appliance that can masquerade the 192.168.x.* packets as 10.y.z.* packets and vice versa. Can this be accomplished via source NAT? Do I even need source NAT?

Right now we have a Cisco RV320 router which can do site-to-site VPNs but not source NAT (it does PAT but it looks to me like that doesn't include source NAT).

What's the easiest way of accomplishing this?

  • 1
    Are you sure you need to NAT? Since your addresses don't overlap, you probably don't need it.
    – Ron Trunk
    Commented Sep 19, 2017 at 13:42
  • I'd love to do this without NAT but I don't see a straightforward way to do it on the RV320. The problem is that the address range we use on our end (192.168.x.*) is occupied at the other end, so I need to somehow map it to 10.y.z.* which they're not using.
    – user12345
    Commented Sep 19, 2017 at 14:02
  • 1
    Can you be more specific about which address ranges are used in which location?
    – Ron Trunk
    Commented Sep 19, 2017 at 14:10
  • NAT is not needed with different address ranges as you have outlined in your question. By the way, that route does do inside-source NAT.
    – Ron Maupin
    Commented Sep 19, 2017 at 14:31
  • Okay, that's good to know. So I have all the hardware I need, I just need to figure out how to set it up.
    – user12345
    Commented Sep 19, 2017 at 14:36

2 Answers 2


This does happen a bit to have duplicate subnets when trying to setup a vpn. Use your favourite web search engine to search for "site to site vpn with duplicate subnets"

For example: https://learningnetwork.cisco.com/thread/66026

The RV320 is a nice SOHO router and performs well for a small business. Please let us know how you go with your set-up.


Since the private IP addresses on both sides don't overlap there's no need for NAT. Bear in mind that NAT is a kludge and should be avoided where possible.

When you establish a VPN tunnel you need each side to know that the other side's subnet is reached through the tunnel. The easiest way is to set up the static routes 192.168.x.0/24 -> tunnel interface and 10.x.y.0/24 -> tunnel on the far side.

When the default gateway on each side differs from the VPN gateway you also need to add the route on that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.