Internal NAT before establishing a VPN Host-to-Host

Question

We are establishing a host-to-host VPN with our business partner. After we exchanged our IP information they said that our LAN IP range will overlap their LAN IP range and we had to do an internal NAT.

Our current LAN is 192.168.0.1/24 and we need to NAT this range to 192.168.2.27 in order to establish the tunnel.

Our network infrastructure is very simple. We have an optical fiber modem connected to our Cisco RV325 router (WAN port). Our router is connected to an unmanaged switch in it's LAN port.

The Cisco RV325 is the device that will establish the VPN tunnel and do all our LAN work (Gateway, DHCP Server).

I'm not familiar with NATing so I'm not sure if our RV325 can do that internal NAT before establishing the tunnel.

I'll be very grateful if anyone is willing to shed some light or share some advice.

Cisco RV325 VPN web-config:

Answer 1

In the situation of overlapping address ranges, if the source and destination are both in the overlapping range then you will need to NAT both source and destination IP addresses (twice-NAT) if you want to establish a peer-to-peer VPN. I doubt that there is any SOHO-grade router that will do this for you.

If your network is very simple then it may be easiest to re-address depending on how many devices are DHCP and how many are static, and whether there are any other dependencies (such as other VPNs).

BTW I assume that you know that if you join two simple LANs together with a site-to-site VPN then there is no inherent security between the two networks.

Answer 2

There is no way to do it with RV325 alone. But since we had another router (TL-R470T) I figured a way to do it. Consider the rules that were set in our business partner:

object-group network FOO_BAR

network-object host 192.168.2.27

object-group network BAR_FOO

network-object host XXX.XXX.XXX.XXX

network-object host YYY.YYY.YYY.YYY

network-object host ZZZ.ZZZ.ZZZ.ZZZ `

1. Connect the RV325 behind one of the router LAN ports;
2. Assign the IP 192.168.2.27 to the RV325 WAN port;
3. This way, the IP 192.168.2.27 will be available in the Local Group Security > IP Address
4. In our configuration, we also had to set the Local Security Group Type to 192.168.2.27
5. In the Remote Group Setup we had to set the IP Address to XXX.XXX.XXX.XXX
6. That's it, just repeat those steps to every remote IP address you need to connect, e.g. YYY.YYY.YYY.YYY and ZZZ.ZZZ.ZZZ.ZZZ