subscribe to our Youtube


12008 questions

14286 answers


35902 members

0 votes
247 views 1 comments
I've asked this question in another form previously but:

Is it possible to connect two (or more) RUT950s with identical LAN subnets over an IPSec VPN?

Based on information found elsewhere it seems that some form of Network Address Translation is required.

The RUT950s are running RUT9XX_R_00.06.08.5 firmware.

1 Answer

+1 vote


Sorry for the late response. The answer is yes, it's possible to connect two RUT devices with identical subnets over IPsec VPN.

Let's say your current topology uses subnets on both RUT950s.

Now you'll need to choose 2 virtual subnets which will be used for communication between these RUT950s e.g.:

1st RUT950 -

2nd RUT950 -

Navigate to Network -> VPN -> IPsec and for 1st RUT950 you'll need to configure local IP address / subnet mask as and remote IP address / subnet mask as 2nd RUT950 will have inverted configuration - local IP/netmask and remote IP/netmask

If other settings in your IPsec config are correct then by running command ipsec status in CLI you should see that tunnel is installed between ===

Now it'll be needed to do 1:1 NAT by using iptables NETMAP target. These IPtables rules will change source IP for outgoing packets and destination IP for incoming packets.

Navigate to WebUI -> Network -> Firewall -> Custom rules and insert following IPtables rules:

For 1st RUT950:

  • iptables -t nat -I POSTROUTING -s -d -j NETMAP --to
  • iptables -t nat -I PREROUTING -s -j NETMAP --to

For 2nd RUT950:

  • iptables -t nat -I POSTROUTING -s -d -j NETMAP --to
  • iptables -t nat -I PREROUTING -s -j NETMAP --to

Now all that's left is to test configuration, from LAN client of 1st RUT950 ping any remote LAN device by using addressing and for LAN2 to LAN1 use addressing.

By this point LAN to LAN communication is established but RUT950s cannot ping each other. For RUT950 to be able to ping each other it's needed to add additional routing rules:

On 1st RUT950 use command: ip route add dev eth1 src table 220

On 2nd RUT950: ip route add dev eth1 src table 220

Note: when adding route, after dev you should specify interface name which is used to establish IPsec tunnel, this example uses eth1 - wired wan.

Best answer
That's excellent, works perfectly, thanks.