Question

hello,

I created a VPN HUB via RMS with two 950 both having the same LAN subnet but having different IP config on the PCs.

SiteA  PC(192.160.20.19)------(192.168.20.1)RUT950-------VPNHUB-------RUT950(192.168.20.2)--------------(192.168.20.41)PC

SiteA:
from CLI:
#ip r                                                                       
default dev wwan0  scope link                                                                           
10.133.59.165 dev wwan0  proto static  scope link  metric 10                                            
192.168.20.0/24 dev br-lan  proto kernel  scope link  src 192.168.20.1                                  
192.168.20.41 via 192.168.255.13 dev tunT7DItwr                                                         
192.168.255.0/24 via 192.168.255.13 dev tunT7DItwr                                                      
192.168.255.13 dev tunT7DItwr  proto kernel  scope link  src 192.168.255.14  

#ping 192.168.20.41                                                               
PING 192.168.20.41 (192.168.20.41): 56 data bytes                                                       
64 bytes from 192.168.20.41: seq=0 ttl=127 time=286.161 ms                                              
64 bytes from 192.168.20.41: seq=1 ttl=127 time=171.268 ms                                              

the issue is that from the PC (192.168.20.19) ping to 192.168.20.41 is not working, what i'm missing?

#tcpdump -nnel | grep 192.168.20.41                                               
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode                              
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes                               
19:19:51.935010 00:e0:4c:68:7c:f2 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-ha
s 192.168.20.41 tell 192.168.20.19, length 46                                                           
19:19:52.946976 00:e0:4c:68:7c:f2 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-ha
s 192.168.20.41 tell 192.168.20.19, length 46                                                           

SiteB:
from CLI:
#ip r
---same thing

Answer 1

Hello,

That would not work as this is by the design of layer 3 VPNs. You need to have different subnets on both routers for RMS VPN to work correctly. To have the routers in the same subnet, you need to use layer 2 VPNs such as OpenVPN in TAP mode.

Comments

Hello,

TAP mode for client side requires static IP to be configured, i'm using 4G SIM for Internet access. The management is via RMS and the VPN that i configured is a VPN HUB - the default one from RMS. This is also an openvpn but indeed, this is TUN.

In my setup, maybe i can use NAT? Local subnet (192.168.20.19) from RUT950 (left router) to be configured as (10.10.10.19/24) and the right router (192.168.20.41) as (10.10.20.41)? would this work?

Thank you,