How to connect two subnets with same IP-range?

nathaniel

I want to connect two networks (at different sites) and route between them, so that every computer from each of those two networks can communicate with every other. So far so good.

The problem is, on each site the same subnet is used: 192.168.178.0/24. However, the IPs are different, so there are not two hosts with the same IP on those two networks. Can I enable routing by putting their individual IPs in the server.conf and as a network mask 255.255.255.255? Like this:

route 192.168.178.5 255.255.255.255
route 192.168.178.6 255.255.255.255
push "route 192.168.178.9 255.255.255.255"

iroute 192.168.178.5 255.255.255.255 // this may go into the client conf dir
iroute 192.168.178.6 255.255.255.255

Anybody thinks this might work? How likely is it?

maikcat

use bridge mode...

Michael.

nathaniel

Is there a possibility to make it work without? So with dev tun?

I prefer tun because it keeps the ethernet traffic from the wire, so I think there will me more capacity this way. (?)

maikcat

yes it can work by only pushing 32 bit mask routes to each pc in BOTH networks...

to much fuss if you want my opinion...

Michael.

JamesAl

I understand your concern and yes it is possible. You just need some care when handling the gateway. There is a lot of information on the link below.
http://serverfault.com/questions/197752/several-ip-address-within-the-same-subnet-on-the-same-host.
In addition I have listed another helpful link below
http://www.techyv.com/questions/how-connect-two-networks-same-time-xp.

nathaniel

I tried to make a setup with a tap device, but I got some connectivity problems. Before openvpn started up, every system could only reach those in its own network segment. After openvpn startup, the only thing that's changed is that VM4 can now reach 192.168.178.128 (the dynamically allocated new ip for the client).

My test-setup looks like this:

--------------------------                          -----------------
|   VM 2                 |                          | VM 3          |
|OVPN-Server             | Internal Network 1       |IP: (eth2)     |
|eth1: 192.168.178.20    |--------------------------|192.168.178.30 |
|eth2: 192.168.56.20     | 192.168.178.0/24         |               |
|tap0: (ethernet)        |                          |               |
|br0: ...178.20 (on eth1)|                          |               |
--------------------------                          -----------------
          | | 
          | | Host-Only Network: 192.168.56.0/24
          | | 
--------------------------                          -----------------
|   VM 1                 |                          | VM 4          |
|OVPN-Client             | Internal Network 3       |IP: (eth3)     |
|eth2: 192.168.178.10    |--------------------------|192.168.178.40 |
|eth3: 192.168.56.10     | 192.168.178.0/24         |               |
|tap0: 192.168.178.128   |                          |               |
--------------------------                          -----------------

To start it all up, I ran this script with the settings for the OVPN server (eth=eth1 and so on). Then, I started openvpn with this server.conf:

local 192.168.56.20
port 1194
proto udp
dev tap
server-bridge 192.168.178.20 255.255.255.0 192.168.178.128 192.168.178.254
dh /etc/openvpn/keys/dh1024.pem
ca /etc/openvpn/keys/ca.crt
key /etc/openvpn/keys/server01.key
cert /etc/openvpn/keys/server01.crt
ifconfig-pool-persist ipp.txt # file initially empty
keepalive 10 60
comp-lzo

Fairly straightforward. The client (VM1) looks like this:

port 1194
proto udp
dev tap
client
remote 192.168.56.20
ca /root/easyrsa/toclient/ca.crt
key /root/easyrsa/toclient/vpnclient01.key
cert /root/easyrsa/toclient/vpnclient01.crt
comp-lzo

Do I have to set up something to forward layer 2* traffic on VM1 and VM2 ? It looks alot like a bug in the routing, but this is layer 2...

nathaniel

*) /proc/sys/net/ipv4/ip_forward is set to 1.

nathaniel

Ok, just did a little debugging here. It's not routing (or whatever the term for layer two is).

Here are the results of the debugging:
1) The logs are looking very normal, nothing strange in there. I use verb 4.

2) Ping from VM3 to VM4 (192.168.178.40) and reverse produces "Destination Host Unreachable". VM2s tap0 and VM1s tap0 receive ARP-requests, but no replies. On VM1s eth2 arrives nothing.

3) Ping from VM3 to VM1 (192.168.178.10) looses all packets without any error message. The ICMP-Pings arrive at VM2s interfaces and even VM1s tun0, but VM1 is not answering. Instead, it's asking on it's eth2 interface for the MAC (ARP-Request).

4) Ping from VM1 to VM2 (192.168.178.20) produces ARP-Requests in VM1s eth2, but not on it's tap0 (where they should be).

So the interpretation is,
* VM1 is using eth2 instead of both eth2 and tun0 to reach all network segments. How to change this?
* VM1 is also not mirroring traffic from tun0 to it's eth2, to make VM4 reachable.

I thought maybe I got it all wrong and every client has to run openvpn, but even VM1 cannot ping VM2 since it's using the wrong interface. Am I missing a statement in my server.conf? (See previous post)

nathaniel

Ok. Problem solved.

IMHO, the guide here is missing the part that you have to run the bridge-start script also on the client.

Who should I ask to get that fixed or at least written more clearly? There is a big "Bridge Server on [OS]" above that section, so I (falsely) thought it only has to be run on the server....