HowTo ?: Same subnet 192.168.0.0/24 on both ends

MacRonin

I have a configuration question. I have installed the OpenVPN appliance at our ISP where I want to use it to maintain our servers. If I do one thing differently than our actual setup the VPN works perfectly. So the one thing left is the networking conflict.
We are not doing a network to network connection, but individual user to network. While the majority of connections will probably be from the office, a percentage will also be from offsite where the same network conflict can exist.

Our configuration
Data Center is running the current OpenVPN Appliance OpenVPN_as2 for the VPN
Our developers are all OSX users

Our office IP range is (this is where we will normally connect from)
192.168.0.0/24

Our Data Center has two virtual networks hooked up to the OpenVPN box
ETH0 - 10.0.0.0/24
ETH1 - 192.168.0.0/24

We do access some of the resources in the data center via specific IP, but the office is mostly dynamic(except printers) and can be remapped without causing a serious issue.

Obviously I need to take an extra step to keep the two 192.168.0.0/24 networks from stepping on each other but I'm not quite sure how to do this.

I can verify that the core configuration of the VPN is working since if I disconnect from the office network and come in via my Mi-Fi whose network is 192.168.15.0 everything works as it should since there is no conflict. I can then access all servers on either 10.1.0.0/24 or 192.168.0.0/24 But if I come in via the office network(or my cable modem at home), I can get to 10.1.0.0/24 but not 192.168.0.0/24.

Any tips or examples appreciated. I can can provide any config files if needed, but other than our public IP and specifying the two subnets, I am pretty much the defaults from the OVA appliance. BTW 192.168.0.0/24 was specified via the Web UI.

The Johan

In our experience the best solution is to re-IP one of the networks, preferably the one behind the Access Server.

The range 192.168.0.0/24 is just way too common, a subnet collission is pretty much a guarantee with that range.

Alternatively if you wanna take a riskier road you can also just specify single IP addresses. More specific routes will win over less specific routes. So a route pushed by the VPN server to the client for a specific single IP will win over the already present route for the entire subnet. CIDR notation example: 192.168.0.50/32

Note that if on the local network there is something on that IP that you need to use, you've just effectively cut yourself off from that IP while connected to the VPN.

Good luck.

MacRonin

Thanks for the input #novaflash.

I had been hoping to avoid reworking one of the 192.168.0.0/24 networks but that is the path that we started. We went for reworking the one at the ISP since that would only involve updating a single network. If we tried the update on the client end it would have just come back up when we worked from home and were behind a cable/MiFi box which had the same default

The Johan

Glad to be of help, and yeah, I wouldn't advise fixing it on the client end either because clients can be in many different networks, usually with default IP ranges, so you may encounter the same problem all over again later on. Best to fix it on the Access Server side - make the network unique.

Good luck.