0

Below is how the network looks like, the left is my home, and the right is my office.

Now I want to connect to office intranet(192.168.0.0/24, R3). We don't have any vpn device that directly connects to internet. I'm also told that I'm not allowed to set NAT on R2 or R3, but I am allowed to set up vpn server (openvpn or whatever free) in the R2 network (192.168.1.0/24) or R3 network (192.168.0.0/24), maybe the later one is more convenient. In this case the client at home cannot connect to the vpn server as it is unreachable.

enter image description here

so I'm thinking the teamviewer way that put a virtual server, vsite, on the public internet (maybe on amazon or azure cloud) and either the client at home or vpn server in office can talk to it. In this case, is it possible that the client can find and connect to the vpn server via the vsite? Any idea how to achieve this more specifically?

enter image description here

Note: I can change R0 to have the subnet to be 192.168.34.0/24

2
  • This is way too broad. We can only speculate, what type and brand of network equipment you are using and what your current configurations are. – user56700 Jul 19 '19 at 7:53
  • don't know what happened, all my descriptions and one more picture was gone...let me get them back – Marv Jul 19 '19 at 8:00
1

Since the networks overlap - 192.168.1.0/24 is used on both sides - a simple VPN tunnel won't work.

You need to either:

Renumber one side

Most often the simplest solution

Leave out the colliding range

When 192.168.1.0/24 is only used locally and not necessary for remote you can just omit the route through the tunnel.

NAT

You'll need destination NAT for the remote 192.168.1.0/24 network (on each tunnel end) and source NAT for connections from 192.168.1.0/24 local to remote (on each tunnel entrance) as well. The most sane way is to map e.g. 192.168.251.0/24 to 192.168.1.0 from one side and 192.168.252.0/24 to 192.168.1.0 from the other side (and obviously the other way around for source NAT). NAT is an ugly hack and far from ideal, so one of the other solution should be preferred. Some routers can't SNAT and DNAT at the same time, so you'd even need asymmetric routing, potentially introducing more problems.

6
  • yeah, I can renumebr one side to be like 192.168.34.0/24, like my home network, that I have the control. And then, how can I have the client find and access the vpn server? – Marv Jul 19 '19 at 8:47
  • @Marv You need two VPN routers, set up a tunnel between them and take care of the routes (either statically/manually or via a routing protocol like OSPF). If you only need one-way access you can use a client-server VPN. – Zac67 Jul 19 '19 at 19:58
  • the thing is I cannot replace R2 with any other router and I don't have access to R2,either. Do you mean I should replace R1 and R3 with two vpn routers ? – Marv Jul 20 '19 at 8:56
  • If R2 - and the network - are not under your control, your question is off-topic here... – Zac67 Jul 20 '19 at 9:32
  • R2 is not, the rest are – Marv Jul 20 '19 at 9:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.