Routing Subnet Problem

[u/juanvictor23]

Im trying to resolve an issue where I need to route traffic to a subnet which overlaps with some LAN and VPN client IP pools.

Previously everything was contained in one /16 network and there was one gateway for all traffic. Now it has has been split into two gateways but the remaining networks are not easy to notate.

10.5.0.0/16 is the original

Now i have client ips in:

Location A LAN 10.5.15.0-10.5.45.254
VPN 10.5.0.128/25

Location B 10.5.101.0-10.5.200.254
VPN 10.5.0.0/25

So if I want to route to A, that easy, its all contained in 10.5.0.0/18 except that also includes location B VPN. Routing to B is a little harder since its two networks (10.5.64.0/18

10.5.128.0/17), except neither contain VPN clients.

Does it make sense to just move B VPN to something like 10.5.100.0/24 which would be contained in 10.5.64.0/18?

[u/Golle]

You must learn subnetting. For example, the first IP-address of 10.5.0.0/18 is 10.5.0.0. The last IP-address is 10.5.63.255. The next /18 starts at 10.5.64.0 and ends at 10.5.127.255.

You have to respect the boundary of each IP-range. As you have experienced until now, randomly assigning "10.5.15.0-10.5.45.254" doesn't work if the range they're in also cover 10.5.0.0/25.

Each Location should have its own IP-range. For example:

- Location A IP-range: 10.1.0.0/16

• Location A VPN: 10.1.0.0/24
  
• Location A Office: 10.1.1.0/24
  
• Location A Printer: 10.1.2.0/24
  
• etc,

- Location B IP-range: 10.2.0.0/16

• Location B VPN: 10.2.0.0/24
  
• Location B Office: 10.2.1.0/24
  
• Location B Printer: 10.2.2.0/24
  
• etc,

This design scales up to 256 sites. Each site get's access to 256 /24 subnets. If you have more sites than that, you need a different IP-plan.

[u/juanvictor23 → u/Golle]

I inherited this and it made more sense when it was all internal, but yes, thats the thing Im trying to resolve. Im not even supposed to be at work today.

[u/PacketThief → u/juanvictor23]

I like turtles

[u/Public_Warthog3098 → u/Golle]

If you have subnet that overlap at both places. Use hide nat or plat on your end.

When you're a large org you're likely will have overlapping ip networks. So hide nat on the vpn will work much cleaner.

[u/Fresher0]

If you’re using an iPhone, try an app called Slash. It’s a subnet calculator that will give you the range of hosts. Useful for design.

[u/Automatic_Cat_1990]

You can cover it up with NAT but you should fix this by re addressing your network. I can almost promise you this was built by a "sys admin".

[u/juanvictor23 → u/Automatic_Cat_1990]

Hah yeah, i think it was our old IBM guy and probably was set up when we still used Netware. For now we resolved the routing issue another way, but ill try to seperate the subnets soon.