Home IP range overlap with Work VPN

NickH 0 · Mar 8, 2021, 11:26 AM

Hello All

First time here and first time pfsense user.

I moved over to a netgate 2100 on the weekend. I have nothing fancy initially just a wan and lan as it is out of the box.
This morning i try to connect to the vpn at work and nothing was working. After investigation turns out the new ip range i chose for the pfsense default lan network overlaps with the work vpn client ip range (i cant believe my luck).

Now i only need the one device to vpn in and i dont really want to go and reconfigure everything again on the netgate.

My question is this - can i create a new vlan and apply it only to this work device and put it in a different range to the default lan so it when i vpn in it doesnt overlap?

Thanks in advance

JKnott · Mar 8, 2021, 11:44 AM

@nickh-0

Ah... The joys of NAT.

Why not just pick a different subnet for your network. I ran into this problem years ago, when I was travelling with my work and would find the hotel subnet conflicted with my home network. I moved my home network to the 172.0.0.0 range, which is rarely used elsewhere.

NickH 0 · Mar 8, 2021, 1:41 PM

@jknott
Thanks for the reply. usually i would, but being a consultant and working with various clients and projects the risk of running into an overlapping IP is high and need a permanent solution to allow me to "adapt" and was thinking i could have a vlan that i can change as needed rather than continuously changing my home subnet - if that makes sense.

JKnott · Mar 8, 2021, 2:04 PM

@nickh-0 said in Home IP range overlap with Work VPN:

and projects the risk of running into an overlapping IP

That's why I went with something in the 172. range. I have only once seen anything there, but there are plenty in the 192.168 & 10. ranges. Then, when you do pick a subnet, don't pick one that ends in 0, 1, etc., to stay away from popular choices.

NogBadTheBad · Mar 8, 2021, 1:51 PM

@nickh-0 said in Home IP range overlap with Work VPN:

@jknott
Thanks for the reply. usually i would, but being a consultant and working with various clients and projects the risk of running into an overlapping IP is high and need a permanent solution to allow me to "adapt" and was thinking i could have a vlan that i can change as needed rather than continuously changing my home subnet - if that makes sense.

Use 172.31.255.0/24, most of your customers if they have their heads screwed on won't allow split tunnels.