<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">Hi Tobias,</div><div class=""><br class=""></div><div class=""><blockquote type="cite" class="">How does it do that? Do you mean it allocates addresses from<br class="">
10.0.0.0/24 to those clients? (Without the server being aware of that,<br class="">
which is not a good idea.) Or does it NAT traffic from these devices to<br class="">
the IP address it received from the VPN server?</blockquote></div><div class=""><br class=""></div><div class="">The idea is that the client has its connection configured with e.g. “leftsubnet=192.168.1.0/24” and each device located on the 192.168.1.0/24 subnet allocates a virtual IP address from 10.0.0.0/24.</div><div class=""><br class=""></div><div class=""><blockquote type="cite" class="">So why not use distinct subnets? Reaching these devices from other<br class="">
hosts (e.g. behind the VPN server, or the server itself) could be tricky<br class="">
if they have the same IP addresses assigned. And depending on the<br class="">
traffic selector on the server's side and whether you use marks this<br class="">
will actually result in duplicate IPsec policies, which won't work.</blockquote></div><div class=""><br class=""></div><div class="">Many of our customers that are setting up these "clients" are already connected to a VPN when they wish to connect to the devices. To avoid conflicts, we thought the customer could select the virtual subnet. If it is possible to set up duplicate
subnets, there is no need to check if a certain subnet is available for the customer to use.</div><div class=""><br class=""></div><div class=""><blockquote type="cite" class="">And are you sure this would be easier with a site-to-site setup instead<br class="">
of using virtual IP pools in the first place? The IP addresses used on<br class="">
the client end could still be "virtual IPs", i.e. only usable inside the<br class="">
VPN, but they wouldn't be assigned by the server (to use duplicate<br class="">
subnets is still tricky, though).</blockquote><br class=""></div><div style="orphans: 2; widows: 2;" class="">Yeah, any setup will do as long as we can duplicate the subnets. I was hoping that it could be done as I read in the Virtual IP wiki that it might have been possible before: “<span style="background-color: rgb(255, 255, 255);" class=""><font color="#36000c" face="Verdana, sans-serif" size="1" class="">previously
each connection would use it's own copy and the same virtual IP may have been handed out to different clients</font></span>”.</div><div style="orphans: 2; widows: 2;" class=""><br class=""></div><div style="orphans: 2; widows: 2;" class="">Regards,</div><div style="orphans: 2; widows: 2;" class=""><br class=""></div><div style="orphans: 2; widows: 2;" class="">Marwan</div><div class=""><br class=""></div>
<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 16 Oct 2018, at 12:28, Tobias Brunner <<a href="mailto:tobias@strongswan.org" class="">tobias@strongswan.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi Marwan,<br class=""><br class=""><blockquote type="cite" class="">3. Client1 connects multiple devices to the VPN, each device has a<br class="">
unique virtual IP address and can be accessed through Client1’s VPN<br class=""></blockquote><br class="">
How does it do that? Do you mean it allocates addresses from<br class="">
10.0.0.0/24 to those clients? (Without the server being aware of that,<br class="">
which is not a good idea.) Or does it NAT traffic from these devices to<br class="">
the IP address it received from the VPN server?<br class=""><br class=""><blockquote type="cite" class="">6. Same as step3, however these devices are not accessible from<br class="">
Client1’s VPN and vice versa<br class=""></blockquote><br class="">
So why not use distinct subnets? Reaching these devices from other<br class="">
hosts (e.g. behind the VPN server, or the server itself) could be tricky<br class="">
if they have the same IP addresses assigned. And depending on the<br class="">
traffic selector on the server's side and whether you use marks this<br class="">
will actually result in duplicate IPsec policies, which won't work.<br class=""><br class="">
And are you sure this would be easier with a site-to-site setup instead<br class="">
of using virtual IP pools in the first place? The IP addresses used on<br class="">
the client end could still be "virtual IPs", i.e. only usable inside the<br class="">
VPN, but they wouldn't be assigned by the server (to use duplicate<br class="">
subnets is still tricky, though).<br class=""><br class="">
Regards,<br class="">
Tobias<br class=""></div></div></blockquote></div><br class=""></body></html>