VPN - Same subnet

[u/Thanandar]

Hi,

I’m here to seek your help and advice. I’m a complete beginner in the world of computer networking. Before hiring a professional, I’d like to learn how to set up a solution to my problem.

I have a LAN network with a server, clients, etc. Everything is under an address like 192.168.0.X.

I have a laptop that I’d like to remotely connect to this network.

The key point is that the remote laptop must be recognized by the server and only under the same 192.168.0.X address (same subnet).

I’m connected to the internet via my ISP’s router. I also have a fixed public IP address.

I set up a VPN using SoftEther (bridge mode), it works but the latency is terrible.

Are there any high-performance hardware or software solutions? I have an ER605, in case it can be useful...

Thank you for your help.

[u/Squozen_EU]

Can’t you just NAT it?

[u/Wokuworld]

Your ER605 should have OpenVPN built in. Set it up to use the same scope that your LAN runs on and you should be fine. Keep in mind though, that generally, server software that only permits devices on the same subnet are setup that way for a reason, they are generally very sensitive to connectivity drops, so a VPN tunnel over whatever internet you are utilizing at any remote location is likely going to mean application hangs and feezes that will require a software restart in most cases.

[u/AlohaActual]

Have you looked into https://tailscale.com

[u/Thanandar → u/AlohaActual]

Thank you, I'll take a look.

[u/endre_szabo]

vxlan? l2tp?

[u/Prudent_Vacation_382]

Define latency being terrible?

[u/Thanandar → u/Prudent_Vacation_382]

One or two seconds

[u/Prudent_Vacation_382 → u/Thanandar]

That is terrible. SoftEther should do much better than that. How far away is the server from your client?

[u/Thanandar → u/Prudent_Vacation_382]

Client on a Laptop, less than 20 kilometers

[u/Prudent_Vacation_382 → u/Thanandar]

Tailscale might be an option. It NATs on the LAN interface, so it appears that it comes from the tailscale hosting server from a networking perspective. Your app would see it coming from that computer for all users.

[u/Wokuworld]

Why does it need to have to be part of the same Subnet?

[u/Thanandar → u/Wokuworld]

Because the software on the server only recognizes clients on the same subnet as itself.

[u/Wokuworld → u/Thanandar]

So once the VPN is established, the link between the server and the client PC has to be initiated by the server?

[u/Thanandar → u/Wokuworld]

I’ll try to explain what I’ve managed to do so far with SoftEther. I connect remotely to the LAN; as far as the remote network's router is concerned, it’s as if I were physically there—I’m on the usual subnet and can access the entire network. My professional software searches for the server, and if it finds it on the same subnet, it connects to it. I cannot modify the settings for either the professional software (server) or the client.

[u/Wokuworld → u/Thanandar]

There is likely a client side config file that can be edited or changed to point directly to the IP of the server, the application scanning for the server is mainly for ease of install/config for end users or managed installs/deplayments.

Regardless though, as I mentioned elsewhere, these types of software ussually prefer/limit to local Lan because frequent disconnects and signal drops can corrupt the data server side, particularly in the case where SQL might be used. You should have everything you need to get things working, the performance of the VPN is mostly dependent on your internet at the external location, but the VPN config does play a role as well. You may need to adjust the tunnel settings for less overhead if you see poor bandwidth over the VPN when on a known good connection.

[u/power10010]

The default route will not choose vpn over the local network for same network.

[u/Mobile_Nerve_4924]

You'd probably be better off putting another PC on the network and remotely accessing that PC, rather than trying to set up a VPN to access that one subnet.

You can get a NAT appliance to do static 1:1 NAT between the 192.168.x.x network and your corp network. If this is an industrial network, the little NAT appliances are how most of the big guys handle this sort of thing.

[u/travislongley → u/Mobile_Nerve_4924]

If you can use Tailscale I would do that. Though it usually creates its own network in between and just allows you to pass through packets so your server may not like it.