Child Item

Site Totals

61215 Questions Answered 267 Categories

VPN and DHCP Range

I am trying to setup VPN access to my kids school and what we have found, for some odd reason, is that we cannot connect when using an 192.168.1.X DHCP range. It appears to work okay with a 10.1.1.X range as verified by a network consultant at the school (a parent). I don't believe she is on Verizon FIOS though. Is there any problem changing the DHCP range on the FIOS router to a 10.1.1.x range - we have 3 set top boxes, a Wii, and 4 computers (Macs)? I don't want to screw up my set top boxes as my family would start a mutiny.

Is there another option to getting out on a 10.1.1.x address such as adding another router. I don't suspect you could have both a 192 and a 10 attached to each other.

Thanks for any/all help

Comments

viafax999

@orfpilot wrote:
I am trying to setup VPN access to my kids school and what we have found, for some odd reason, is that we cannot connect when using an 192.168.1.X DHCP range. It appears to work okay with a 10.1.1.X range as verified by a network consultant at the school (a parent). I don't believe she is on Verizon FIOS though. Is there any problem changing the DHCP range on the FIOS router to a 10.1.1.x range - we have 3 set top boxes, a Wii, and 4 computers (Macs)? I don't want to screw up my set top boxes as my family would start a mutiny.
Is there another option to getting out on a 10.1.1.x address such as adding another router. I don't suspect you could have both a 192 and a 10 attached to each other.
Thanks for any/all help

I believe that changing the VZ router's subnet will prevent your STB's working correctly.

There is no reason why you can't connect a second router to the VZ router and have it using a 10.1.1 subnet. Connect a LAN port of the VZ router to the WAN port of the new router and have it issuing dhcp leases on the 10.1.1 subnet, connect your machine to the new router.

However I fail to see why that should make a difference, also when you connect from the a machine in such a setup the 192.168.1.something (the address of the new router) will appear in IP return path list so may still cause issues,

Does the network consultant have an explanation of why the schools VPN access should have such an oddball restriction since 192.168.1 is the most common default gateway router access and banning such access serves no useful purpose as protection on the vpn is presumably by some form of passcode, at the most simple level a user id and password.

orfpilot

Thanks for the reply. What the consultant thinks is the problem is the school's internal DHCP range is the 192.168.1.x and the home network is the same range, so because you are trying to VPN from a 192 range into a 192 range, there is some conflict. She did it at her home with the same problems using the 192 range, but when she changed it to the 10.1.1.x range, the VPN connection went right through. So it's not a password problem. She does networks engineering for a living, so I think she know what she's doing. We are trying to go from PCs and Macs to Linksys VPN router.

viafax999

Hmm, I do that all the time with no issue, maybe some quirk with the Linksys VPN router.

Whatever, using a second internal router as I said will give you the required 10.x subnet address and if as she surmises their is an issue with the client machine using the same local subnet as the vpn destination then it should resolve your issue.

lasagna

The address overlay is likely the cause of your problem. Having both 192.168.1.x as the "local" IP space as well as the "remote" IP space can cause some clients to get confused depending on how the VPN tunnel is configured and the addresses of critical devices in the network which may be overlaid in your address space. As the 192.168..x.x space tends to be the most commonly used RFC1918 space used by residential routers, most companies which are using RFC1918 space for their networks (schools included) typically avoid that space and instead use something in the 172.16.x.x or 10.x.x.x space instead -- unfortunately, the school you're dealing with didn't have the foresight to do this.

You can change your local address range to something other than 192.168.1.x. Your STB's will continue to work. However ... there are several side effects. One is that none of the remote tools (DVR programming, Verizon.net status check, etc.) will work because they all assume that the router has the 192.168.1.x address space. The other is that Verizon tech support will become totally confused and be unable to provide any support in this configuration -- I actually had my home setup in the 192.168.108.x range for the longest time, but literally had technicians insist that is was impossible despite the evidence in front of them. Regardless of the reasoning, I do not recommend changing the network range that the STB's are on just to insure you don't impact the operation of the STB's or Verizon's support.

You can use a second router behind the Verizon router -- this is in fact the easiest way to solve the problem. Hook the WAN interface of this router to the a LAN port on the Verizon router. Configure the local LAN on the second router to use an address space that is non-conflicting (10.x.x.x) and attach any devices which you want to VPN from to this device (either directly or by configuring a second SSID -- different than the Verizon one). Even though there is still a local 192.168.1.x network in the path, it is no longer directly seen by the PC's which are initiating the VPN connection and thus the address space conflict is no longer an issue.

Should be all you need to do to get things up and running.

eljefe2

I have my Actiontec set to 192.168.0.1. DHCP range = 192.168.0.100 through .150. Numerous devices set to static IP's between 192.168.0.10 and .99. All devices work properly, including remote DVR control via an iPhone app or the TV Central web site.

It seems to me that the OP could change his home network to 192.168.0.xxx and it would (or at least might) solve the problem without too much effort.

Child Item