Routing when clients are on same subnet

ryangriggs

Hello, I am trying to configure an OpenVPN installation with a server and multiple clients. Unfortunately all clients share the same subnet with the server site. (192.168.100.xx) We are unable to change this due to several issues.

Is it possible to configure a Routed VPN setup, and simply route the specific IP addresses to the various client connections?

Here's an example which I tried:
The server IP is 192.168.100.13
One client site has an IP address, 192.168.100.37, that we need to talk to from the main site.
I added the following to my Server's OpenVPN configuration:

[oconf=]
route 192.168.100.37 255.255.255.255
push "route 192.168.100.13 255.255.255.255"
[/oconf]

Then I established the OpenVPN connection, which reports that everything initialized successfully. However, I can't ping either IP address from the other side of the tunnel.

Do I have to use Bridged mode in this setup? If so, I need to prevent any unnecessary traffic from crossing the VPN (i.e. broadcast packets, etc) since the client sites use metered connections.

Thank you for any advice on setting this up!

Ryan

TinCanTech

ryangriggs wroteThank you for any advice on setting this up

ryangriggs wrote Unfortunately all clients share the same subnet with the server site. (192.168.100.xx)

Change this ..

ryangriggs

@TinCanTech

Unfortunately I cannot change the subnet setup. We have multiple sites that were configured by a vendor previously, and they decided it would be "easier" to use the same subnet across all sites, including the main office. The remote sites are transferring data to the main site via data radios (this is an industrial SCADA system). We don't have programming software for some of the equipment, and all the PLCs would need modifications to be configured for a new set of subnets. This is simply too expensive and would require too many changes.

Thanks.

ryangriggs

Wouldn't bridging work in this instance? As long as we could block broadcast packets, I think the data usage would be reasonable...

TinCanTech

This sounds too complex for a simple solution to work.

If you would like some professional assistance: tincanteksup <at> gmail