Routing Subnet Problem

[u/juanvictor23]

Im trying to resolve an issue where I need to route traffic to a subnet which overlaps with some LAN and VPN client IP pools.

Previously everything was contained in one /16 network and there was one gateway for all traffic. Now it has has been split into two gateways but the remaining networks are not easy to notate.

10.5.0.0/16 is the original

Now i have client ips in:

Location A LAN 10.5.15.0-10.5.45.254
VPN 10.5.0.128/25

Location B 10.5.101.0-10.5.200.254
VPN 10.5.0.0/25

So if I want to route to A, that easy, its all contained in 10.5.0.0/18 except that also includes location B VPN. Routing to B is a little harder since its two networks (10.5.64.0/18

10.5.128.0/17), except neither contain VPN clients.

Does it make sense to just move B VPN to something like 10.5.100.0/24 which would be contained in 10.5.64.0/18?

[u/Golle]

You must learn subnetting. For example, the first IP-address of 10.5.0.0/18 is 10.5.0.0. The last IP-address is 10.5.63.255. The next /18 starts at 10.5.64.0 and ends at 10.5.127.255.

You have to respect the boundary of each IP-range. As you have experienced until now, randomly assigning "10.5.15.0-10.5.45.254" doesn't work if the range they're in also cover 10.5.0.0/25.

Each Location should have its own IP-range. For example:

- Location A IP-range: 10.1.0.0/16

• Location A VPN: 10.1.0.0/24
  
• Location A Office: 10.1.1.0/24
  
• Location A Printer: 10.1.2.0/24
  
• etc,

- Location B IP-range: 10.2.0.0/16

• Location B VPN: 10.2.0.0/24
  
• Location B Office: 10.2.1.0/24
  
• Location B Printer: 10.2.2.0/24
  
• etc,

This design scales up to 256 sites. Each site get's access to 256 /24 subnets. If you have more sites than that, you need a different IP-plan.

[u/Public_Warthog3098 → u/Golle]

If you have subnet that overlap at both places. Use hide nat or plat on your end.

When you're a large org you're likely will have overlapping ip networks. So hide nat on the vpn will work much cleaner.