Site2Site VPN with IP-based routing (no subnet)

[itBJA]

Hi,
I have the challenge, that most of our systems will migrate to a different comuting centre, some will stay on premises.
As my predecessor only used IP-addresses to configure the connections between the systems, for services to listen etc. it is not possible for me, to change the IP-subnet neither for the systems to be migrated nor for the systems staying on premises.

So I need to set up the VPN-Tunnel to the remote site like
172.16.84.1 - 172.16.84.98 as remote net and also 172.16.84.92 - 172.16.84.254
Just an example.

How can I realize this without adding every IP to the routing as single address?
Can I use Aliases here?

Firewall on premises will be a 8200 Max PFSense, remote side is either AWS internal VPN or PFSense virtualized.

[viragomann]

@itBJA said in Site2Site VPN with IP-based routing (no subnet):

So I need to set up the VPN-Tunnel to the remote site like
172.16.84.1 - 172.16.84.98 as remote net and also 172.16.84.92 - 172.16.84.254

You have to embody this with multiple subnets.

Just an example.

So there is no sense to try it.

Alternatively, if there are equal network ranges on both site you can masquerade one with BINAT.

[keyser]

@itBJA You can’t do that as any given client will no use it’s default gateway to reach an IP it believes is in its own subnet - routing will never come into play. So unless you can change the subnet mask - and happen to be in the situation that what you are moving happens to be fx. The upper 128 addresses of the range, then it won’t work.

Neither will Binat masqerading if the applications residing on both sides of the VPN are hardcoded to contact the same IP subnet as they themselves are located in.

You should probably look into a OpenVPN TAP based VPN tunnel as that extends your layer two across two sites. But don’t expect miracles, and it will likely not work with a latency prone distance/link….
It goes without saying that is POOR network design to use such an abomination, but sometimes life leaves you no other options….

[michmoor]

Seems like a perfectly good use case for Tailscale