VPN Configuration using IPSec

[travisco_nabisco]

I am currently working on a project at work that involves placing a cellular modem and router on a train with the requirement that someone on a corporate network be able to connect to the train using an IPSec VPN connection.

The device we have on the train will be configured to accept VPN connections from the WAN IP of the corporate network.

Our current setup, which doesn't quite meet all the requirements, is that the device associated with the WAN IP of the corporate network, a VPN router, is responsible for opening and closing the VPN connection. This puts in a limitation that only a single user can connect to a single train at a time.

I need to come up with a configuration where more than one VPN can be used at a time. ie there will be one user connected to one train, and at the same time another user connected to another train. Each train has identical static IP assignments.

Is there a way to have the on train VPN router accept a connection that initiates directly from a computer on the corporate network?

Here is a general diagram of what I am trying to create.

 

[jdabbs]

Our current setup, which doesn't quite meet all the requirements, is that the device associated with the WAN IP of the corporate network, a VPN router, is responsible for opening and closing the VPN connection. This puts in a limitation that only a single user can connect to a single train at a time.

Having a router that only supports a single VPN tunnel is a fairly significant limitation for your scenario. Spend a little money, get a Cisco ASA 5510 or equivalent. Configure a tunnel for each train. On each train, the remote network should be the corporate network, or whatever IP they NAT to.

Ensuring the cellular modem retains the same public IP could be a problem; I would discuss options with your provider.

 

[travisco_nabisco]

Thanks for the reply.

The issue isn't that the VPN router doesn't support more than one tunnel, it is that every train has the same set of IP addresses for the internal portion of the train's LAN. If I open a tunnel to more than one train there will be an IP conflict, unless I am missing something.

We are specing that the cellular modem have a static IP.

 

[jdabbs]

Thanks for the reply.

The issue isn't that the VPN router doesn't support more than one tunnel, it is that every train has the same set of IP addresses for the internal portion of the train's LAN. If I open a tunnel to more than one train there will be an IP conflict, unless I am missing something.

We are specing that the cellular modem have a static IP.

That's fairly easy to work around--NAT the train network to the public IP, setting up port forwarding as necessary. If you have multiple devices on a train that use the same port, and redirection isn't an option, you can (from the corporate network) NAT the outside local IP, forward that packet through the VPN, and have the train network handle the translation to the device IPort.

 

[thiggins]

But you can't have the same subnet on the private side of the NAT, right?

 

[jdabbs]

But you can't have the same subnet on the private side of the NAT, right?

Sure you can. Each train would propose its public IP as the secure network (public IP/32 instead of 192.168.0.0/24 or whatever).

Train A: Public 1.2.3.4 Private 192.168.0.0/24
Train B: Public 2.3.4.5 Private 192.168.0.0/24

On each train, the Foo server is NAT'd to public IPort 80. A device on the corporate network would access Train A's Foo server via 1.2.3.4:80.

 

[thiggins]

Hmmm. Why have I had trouble in the past when setting up test VPNs with two routers with the same private IP?

 

[travisco_nabisco]

If you are using the build in Microsoft VPN client the two subnets to need to be different. At least that is what an article you put together a few years ago says.

The two ends of the VPN tunnel must use different subnets

In our example, the WAN-side client is in the 192.168.3.X subnet and the wired client in 192.168.1.X, which satisfies this requirement.

From http://www.smallnetbuilder.com/lanwan/lanwan-howto/24429-howtoxpipsec?start=1

 

[jdabbs]

I wouldn't be able to give a definitive answer without more information on the scenario.

If it's something like:
Routers A and B cabled together via their WAN ports
LANs use the same subnet

A laptop on Router A LAN attempt to connect to a NAS on Router B would fail as the laptop would incorrectly determine (based on the IP) that the NAS is on the same broadcast segment instead of forwarding the packet to the default gateway.

This scenario is different from the OP's problem since 1) although there is IP overlap, communication is corp>train rather than train<>train (so no two overlapping subnets communicate with each other), and 2) the destination IP would be the train's public IP instead of an IP on the train's internal subnet.