TexasCHLforum.com

dhoobler wrote: ↑Wed Sep 16, 2020 9:27 pm Here is my contribution of a sample configuration. I split your network, 192.168.73.0/24 into two networks, 192.168.73.0/25 and 192.168.73.128/25. The subnet mask is 255.255.255.128.

Each of the internal hosts, of any type, must have an IP address from within its own network. You must assign the IP address, 192.168.73.1 to the internal network interface of the gateway (router) for network A. You must make that IP address the default gateway of each host within the private A network.

Similarly, for network B, the internal interface of the gateway must have an IP address of 192.168.73.129. That must be the default gateway of each host within the private B network.

If a host in network A needs to access a host in network B, it can do so by IP address, or by a local host table. I don't think you want to get into DNS.

The trick to making this work is to configure the tunnel between gateway A and gateway B. That is not a trivial task. It includes setting up encryption methods, data integrity and key exchange. In addition to that, gateway A must "know" that the private network, 192.168.73.128/25 is behind gateway B. Likewise, gateway B must "know" that the private network, 192.168.73.0/25 is behind gateway A. the two gateways must have routing between the two private networks configured. This is not necessarily a trivial task.

Key to understanding this is to understand the relationship between the IP address and the subnet mask. The standard class C network, 192.168.73.0 with subnet mask, 255.255.255.0 is one contiguous network. If you change the subnet mask to 255.255.255.128, 192.168.73.0 through 192.168.73.127 belong to one network and 192.168.73.128 through 192.168.73.255 belong to a different network. This is why they can be split up between the two sites. You do not have to do this. You could use two entirely different private networks.

I am assuming that the two gateways are connected to the Internet with static public IP addresses. If they do not have static IP addresses, things get more complicated.

I assumed that your gateway and switch are separate pieces of hardware. This may not be the case. The gateway might have enough ports to connect all of your internal hosts.

Recall that in this scenario, you cannot use the IP addresses 192.168.73.0 or 192.168.73.128. These are used for routing. You cannot use 192.168.73.127 or 192.168.73.255. These are broadcast addresses.

dhoobler wrote: ↑Tue Sep 15, 2020 2:09 pm I concur with parabelum that you cannot use a subnet mask of 255.255.255.255. If you could post a sketch of the network with IP addresses, I might get a better handle on your configuration.

rtschl wrote: ↑Tue Sep 15, 2020 3:35 pm Calculating subnets is not fun. Here's an online one I have used several times: http://www.subnet-calculator.com/

Spiceworks also has one to help you easily divide: https://community.spiceworks.com/tools/subnet-calc/

dhoobler wrote: ↑Sun Sep 13, 2020 5:30 pm I do not know about your repeaters. I cannot comment on whether or not they are interfering with the VPN function. I can offer an explanation about IP addresses.

The relationship between IP address and subnet mask can be confusing. An IP address is a string of 32 bits. The dots are for human consumption. Your computer does not see them.

The 32 bits of the IP address is split between a network part and a host part. The split between the two is determined by the subnet mask.

There are three standard subnet masks, 255.0.0.0 (class A), 255.255.0.0 (class B) and 255.255.255.0 (class C). The bits in the subnet mask that are 1 indicate that the corresponding bit in the IP address is network part of the IP address. The zeros indicate host part. As an example, your IP address, 192.168.73.2 with subnet mask 255.255.255.0 looks like this: 11000000101010000100100100000010. The network part is 110000001010100001001001. The host part is 00000010. If the subnet mask had been 255.255.255.128, the network part would be 1100000010101000010010010 and the host part would be 0000010. The subnet mask must be a contiguous string of 1's followed by a contiguous string of 0's. 255.0.255.255 would be an illegal subnet mask.

There is no rule that says that the subnet mask must be standard, Class A, B or C. A subnet mask of 255.255.255.128 is perfectly legal. It would split a class C network into two subnets, each of which had 128 IP addresses.

The first IP address of a subnet is used for routing. It cannot be assigned to a host. The last IP address of the subnet is the broadcast address. It cannot be assigned to a host. In your example, 192.168.73.0 with subnet mask 255.255.255.0, the broadcast address is 192.168.73.255. If you made the subnet mask 255.255.255.128, the broadcast would be 192.168.73.127. You would be limited to addresses in the range of 192.168.73.1-126.

A host directly communicates only with other devices within its own subnet. It actually uses a MAC address, not IP address to communicate. Your computer maintains an ARP table (Address Resolution Protocol) to translate between IP address and MAC address. If you are sending to an IP address outside of your own subnet, your computer either sends to a dedicated route or (more likely) to the default gateway. If you want to see your computer's default gateway, open a CMD window and enter ipconfig /all. While you are there, you can view your ARP table by entering arp -a.

You might be able to change your subnet mask to 255.255.255.128 and use 192.168.73.x behind both gateways. You would use 192.178.73.1-126 behind one and 192.168.73.129-254 behind the other. !92.168.73.0, 192.168.73.127, 192.168.73.128 and 192.168.73.255 would not be usable because they are network addresses and broadcast addresses. I don't know how your would accomplish this, given your configuration was done by script.

dhoobler wrote: ↑Sun Sep 13, 2020 3:28 pm I have set up a number of VPN's, although not with Linux. My experience is with Check Point. That said, the principles are the same.

You have two devices (gateways) connected to the Internet at different locations, each with its own static IP address. I am going to make some assumptions at this point.

You have a private network at behind each device with the public static IP address. You wish to route traffic from the private network behind one gateway to a destination inside the private network behind the other gateway. The gateways have the VPN feature built in.

First some concepts. Private IP addresses (192.168.x.x and others - see RFC1918) cannot be routed through the Internet. If you try, your ISP will drop the packets. In order to access the Internet from a private IP address, your gateway performs Network Address Translation (NAT) to substitute its own public IP address (either static or dynamic) for your private IP address.

A VPN must be able to route your private IP address from one private network to another private network. It does so by setting up a "tunnel" between the two gateways. It routes packets using its own public IP address in such a way that the remote gateway can disassemble the packet and route the packets internally.

The gateways must also know which private IP addresses belong to which gateway, so it knows where to route private traffic. It does this by use of an encryption domain and VPN routing. Each gateway must have its own unique encryption domain (i.e., set of private IP addresses).

Beyond that the two gateways must have a mutually agreed upon method of creating the tunnel. There is a lot that goes into tunnel creation that I cannot comment on without knowing more about the specific gateways. Things to look for are shared secret, data integrity, encryption method, etc.

The gateways might make tunnel creation transparent. It might be that you just need to address the encryption domains and the NAT. The first thing I would look at is to make sure you are not using the same private IP addresses behind the two gateways. The next thing I would dig into is the NAT configuration. It must be disabled within the VPN tunnel, then VPN routing.

That is a lot to digest. I hope it helps.

Crossfire wrote: ↑Sat Sep 12, 2020 7:13 pm If you are using IPv6 addressing, try disabling it, and use IPv4.

parabelum wrote: ↑Sat Sep 12, 2020 10:23 pm Are you using static or dynamic IPs at the router?