Overlapping subnets with IPsec solution

Main Page > General Information > Configuration Examples > VPN > Overlapping subnets with IPsec solution

The information on this page is updated in accordance with the 00.07.17.4 firmware version.

Introduction

This article provides an extensive configuration example with details on how to configure Ipsec with overlapping subnets.

Configuration overview and prerequisites

Prerequisites:

Two RUTxxx routers of any type.
A SIM card with a Public Static or Public Dynamic IP address for the IPsec server.
An end device (PC, Laptop, Tablet, Smartphone) to configure the
Installing package via package manager on both devices: IPtables NAT extra

Configuration scheme:

Router configuration

If you have familiarized yourself with the configuration scheme and have all of the devices in order, we can start configuring the routers using instructions provided in this section.

Basic tunnel

First of all, let’s configure a simple connection between two IPsec instances, i.e., RUT1 and RUT2.

RUT1 configuration

Enable instance.
Remote endpoint (Only one side of IPsec needs to have it configured)
Enter the Pre shared key(a shared password used for authentication between the peers. The value of this field must match on both instances).
Select tunnel Type
Enter Local subnet (an IP address/Subnet mask of the router on which the IPsec instance is configured).
Enter Remote subnet

RUT2 configuration

Enable instance.
Enter Remote endpoint
Enter Pre shared key (a shared password used for authentication between the peers. The value of this field must match on both instances).
Select tunnel Type
Enter Local subnet (an IP address/Subnet mask of the router on which the IPsec instance is configured).
Enter Remote subnet

Check IPsec tunnel status

If you’ve followed all the steps above, your configuration should be complete. However, as with any configuration, it is wise to test the setup to ensure it works properly. This can be verified by running swanctl --list-sas command in RUT CLI, you should see tunnel between virtual networks:

root@RUT1:~# swanctl --list-sas 
Server: #7, ESTABLISHED, IKEv1, da0c8d300529bd5a_i 812482f852fb55b7_r*                                                                                 
  local  '192.168.2.124' @ 192.168.2.124[500]                                                                                                        
  remote '192.168.2.145' @ 192.168.2.145[500]                                                                                                         
  AES_CBC-128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536                                                                                                    
  established 2409s ago, rekeying in 11816s                                                                                                           
  Server_c: #2, reqid 1, INSTALLED, TUNNEL, ESP:AES_CBC-128/HMAC_SHA1_96/MODP_1536                                                                     
    installed 2408s ago, rekeying in 1017s, expires in 1555s                                                                                          
    in  c0795e33,      0 bytes,     0 packets                                                                                                        
    out c7a0bca0,      0 bytes,     0 packets                                                                                                         
    local  192.168.3.0/24                                                                                                                             
    remote 192.168.4.0/24

Firewall configuration

After establishing IPsec tunnel it's necessary to map LAN network IP addresses to virtual IPsec network addresses, for this we'll use iptables NETMAP target. Insert these IPtables rules into WebUI -> Network -> Firewall -> Custom rules.

RUT1 Firewall configuration

iptables -t nat -I POSTROUTING -s 192.168.1.0/24 -d 192.168.4.0/24 -j NETMAP --to 192.168.3.0/24
iptables -t nat -I PREROUTING -s 192.168.4.0/24 -j NETMAP --to 192.168.1.0/24

RUT2 Firewall configuration

iptables -t nat -I POSTROUTING -s 192.168.1.0/24 -d 192.168.3.0/24 -j NETMAP --to 192.168.4.0/24
iptables -t nat -I PREROUTING -s 192.168.3.0/24 -j NETMAP --to 192.168.1.0/24