Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to understand some basic principle of virtual networks.

Is it (and how is it) possible to let a vpn tunnel work like a switch? So that my local machine is getting an address of the remote net?

Site A:
Net A: 10.1.0.0/16
Internet Gateway: 10.1.0.254
VPN Server A: 10.1.0.200
Some Clients in Network A:
PC1: 10.1.0.1
PC2: 10.1.0.2
...
PC199 etc.
And some File Servers.
DHCP Net A: 10.1.0.253

Site B:
Net B: 192.168.2.0/24
Client B: 192.168.2.2
Internet Gateway: 192.168.2.254

Scenario 1:

Client B should connect to Net A via VPN Server A. Is it possible that it gets an ip-address in range of net A on its vpn interface, eg. 10.1.0.201?

Scenario 2:

Would it be possible that a PC in Network B (VPN_B) acts also as a switch, so that the DHCP of Network A gives the addresses to network B? And all clients of network B connect to the net via the VPN_B?

Scenario 3:

I think that will be the scenario that is most productive: For a single client as in scenario 1 for a net connection:

Network A: 10.1.0.0/16 or 192.168.1.0/24
Network B: 10.2.0.0/16 or 192.168.2.0/24
Network C: 10.3.0.0/16 or 192.168.3.0/24
etc.

and each network has an own DHCP and Gateway. how do I need to configure the VPN Servers that Traffic in the site-spanning 10.0.0.0/8 Net would go through the vpn if the client is not in the same site and external traffice (Web Connection) goes directly through the Internet Gateway.

Does the VPN Server must be configured as the Gateway and routes the traffic either to a "wan"-port or the vpn or would it be possible to use any client in the network as VPN Server

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Scenario 1:

yes, it is possible but not automatic. For instance, OpenVPN has two modes of connection, called bridged and routed. In the bridged mode you get an IP address belonging to the server's subnet, while in the routed mode you do not (you get an IP address in a third subnet, which you choose, but must differ from either local or remote LAN).

Scenario 2:

Confused question. Yes, it is possible to arrange things in such a way that IP addresses for both subnet A and subnet B are dished out by a single DHCP server, belonging to either subnet. Not a smart move, though: if for any reason the connection between A and B is broken, one of the two subnets will be without DHCP server.

Second part of the question: Yes you can. Suppose you have a PC, called PCVPN, in network B, which is connected via VPN to network A. Then all you need to do is to tell all pcs on subnet B that the gateway to the Internet is not your router (192.168.2.254) but is PCVPN. On PCVPN you have to enable the "forward IPv4" option, which is done differently depending on the OS you have.

Scenario 3:

Yes, this can be done, but it will require you to use a router with OpenWRT, DD-WRT or Tomato software installed. This can be achieved in many ways (all pcs of all sites belonging to the same subnet or not, all outside traffic routed through the local gateway or a single specific gateway, and so on), that I cannot give you a single solution. But you can find intros to this here and here. The second solution is my favorite, because it is more complete: you will have a single subnet, say 192.168.1.0/24, with IP addresses 192.168.1.1-127 being given by a gateway on one site, and 192.168.1.129-254 being given by the other gateway on the other side. In this way, all resources of either site are accessible to all pcs, no matter where they are located. Also, this solution routes Internet communication via each local router (in other words, only communications destined for the other local net are routed through the VPN). If instead you wish everything to go through a specific router, say 192.168.1.1, just instruct the other router to use 192.168.1.1 as the default gateway, and it will pass this information on to the PCs to which it gives IP addresses.

The generalization to three or more subnets is trivial, just remember to use ipcalc or some such tool for the computations of the network masks.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.