Connecting over VPN to network that has the same subnet than client

[gregor]

Hi,

 

even though we usually use Cisco VPN clients, I've recently had a weird issue with networking and here it is:

 

- pc (client) on location A needs to connect through VPN to location B. 

- client's local network subnet is 192.168.1.0/24.

- client's external IP is A.B.C.D.

- server local network subnet is same as clients, 192.168.1.0/24.

- server runs VPN server on Microsoft Small Business Server.

- servers external IP is W.X.Y.Z.

 

Connection is successful. However, when trying to access other computers on local network on location B, we found out, because of same subnets, we're still accessing clients networking. 

 

Example (problem):

 

Client > VPN > Server. Success. Client access 192.168.1.10 on server part (should lead to Exchange server). Error. It leads to NAS device (which is on client intranet.

 

Is there any easy workaround for this or is it better to reconfig Work intranet IP's and switch them to 192.168.X.Y?

 

 

Thank you for your help!

[Kai Y]

Don't have much experience with VPN configuration, but I guess it is probably cleaner over the long-term to reconfigure the IPs?

 

However, I've seen an option before in a VPN software (in my limited VPN experience) that allow you to do a "one-to-one NAT", meaning like you can map all the 192.168.1.X on the server side to 192.168.2.X or something (so to access the server via the VPN, the client would use 192.168.2.0 instead). No idea if that works with the Microsoft Small Business Server VPN though.

[gregor]

Don't have much experience with VPN configuration, but I guess it is probably cleaner over the long-term to reconfigure the IPs?

 

However, I've seen an option before in a VPN software (in my limited VPN experience) that allow you to do a "one-to-one NAT", meaning like you can map all the 192.168.1.X on the server side to 192.168.2.X or something (so to access the server via the VPN, the client would use 192.168.2.0 instead). No idea if that works with the Microsoft Small Business Server VPN though.

 

Are we talking about VPN client or VPN server configuration here? It is more logical that VPN client has this option, not server, so Microsoft Small Business Server hasn't got much to do here.

 

But, if we're talking about VPN client, the classic built-in Microsoft client has an option "Use default gateway on remote network option" which is great, except.. it works only for outbound traffic, local network doesn't

[sc302 Veteran]

Change the network on either end. the computer doesn't know which route to take being both on same subnet.

[+BudMan MVC]

Its a common problem with remote vpn connections or site to site vpn setups.. If for example the remote client is 192.168.1.0/24 and the site is he is vpn too is 192.168.1.0/24 your going to have some problems.

or if you have site A 192.168.1.0/24 --- site to site vpn --- Site B 192.168.1.0/24

The best solution is to change one of the locations ip scheme as suggested by sc302. Home users normally have much easier to change their side to say 192.168.27.0/24 so it doesn't fall into the commonly used 192.168.1,2,3.0/24 etc..

If your setting up a business sort of location and will having remote home users, etc. Its good practice to use a bit of oddball local network, say 10.0.82.0/24 or 172.31.0/24,etc..

Worse case depending on the equipment being used, NATs can be put in place - but its more complex and would only suggest you do that if just really not possible to change a locations IP scheme at the current time. But the long term solution would be to make sure all sites in your network use their own unique ip address space that falls in line with your company overall policies.

Other solution that can be done for the remote users that need access to a few machines and the IPs overlap is to create host routes to those specific IPs that push it down the tunnel vs computer just thinking hey 192.168.1.62 is local to my 192.168.1.0/24 network no reason to send that traffic down the tunnel.

But you still can run into issue where the server your talking to says hey 192.168.1.100, depending on the vpn solution used - say if use tap vs tun is trying to talk to me - that is local, no reason to send it back to the gateway to go out the vpn. If remote client gets a vpn IP that is different than every network in use you should be ok with host routes on the remote clients to get to a handful of machines, etc..

In the long run, best solution is to make sure either remote users or remote sites do not have overlapping ip schemes.

[binaryzero]

Both sides have the same subnets, you're gonna have a bad time...