0

We are establishing a host-to-host VPN with our business partner. After we exchanged our IP information they said that our LAN IP range will overlap their LAN IP range and we had to do an internal NAT.

Our current LAN is 192.168.0.1/24 and we need to NAT this range to 192.168.2.27 in order to establish the tunnel.

Our network infrastructure is very simple. We have an optical fiber modem connected to our Cisco RV325 router (WAN port). Our router is connected to an unmanaged switch in it's LAN port.

The Cisco RV325 is the device that will establish the VPN tunnel and do all our LAN work (Gateway, DHCP Server).

I'm not familiar with NATing so I'm not sure if our RV325 can do that internal NAT before establishing the tunnel.

I'll be very grateful if anyone is willing to shed some light or share some advice.

Cisco RV325 VPN web-config: Gateway to Gateway VPN Settings

3
  • 2
    I do not see any option to do this on Cisco RV325 router.
    – Hung Tran
    Jan 10, 2018 at 22:01
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Feb 21, 2018 at 18:18
  • @RonMaupin There is not way to do it with RV325 only, but since I had another router I figured out a way. See the accepted answer. Thanks.
    – randrade86
    Mar 5, 2018 at 15:02

2 Answers 2

0

In the situation of overlapping address ranges, if the source and destination are both in the overlapping range then you will need to NAT both source and destination IP addresses (twice-NAT) if you want to establish a peer-to-peer VPN. I doubt that there is any SOHO-grade router that will do this for you.

If your network is very simple then it may be easiest to re-address depending on how many devices are DHCP and how many are static, and whether there are any other dependencies (such as other VPNs).

BTW I assume that you know that if you join two simple LANs together with a site-to-site VPN then there is no inherent security between the two networks.

0

There is no way to do it with RV325 alone. But since we had another router (TL-R470T) I figured a way to do it. Consider the rules that were set in our business partner:

object-group network FOO_BAR

network-object host 192.168.2.27

object-group network BAR_FOO

network-object host XXX.XXX.XXX.XXX

network-object host YYY.YYY.YYY.YYY

network-object host ZZZ.ZZZ.ZZZ.ZZZ `

  1. Connect the RV325 behind one of the router LAN ports;
  2. Assign the IP 192.168.2.27 to the RV325 WAN port;
  3. This way, the IP 192.168.2.27 will be available in the Local Group Security > IP Address
  4. In our configuration, we also had to set the Local Security Group Type to 192.168.2.27
  5. In the Remote Group Setup we had to set the IP Address to XXX.XXX.XXX.XXX
  6. That's it, just repeat those steps to every remote IP address you need to connect, e.g. YYY.YYY.YYY.YYY and ZZZ.ZZZ.ZZZ.ZZZ

Example

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.