Broadband Tech > Virtual Private Networking > Optimal IP/SubNet/VPN Settings for Home Office PPTP VPN

Optimal IP/SubNet/VPN Settings for Home Office PPTP VPN

My gut reaction (without delving too deeply quite yet) is to avoid multiple networks at all costs. There are VERY VERY VERY VERY few home users who need multiple networks. It just causes more problems than it's worth. The ONLY ppl that should be using multiple networks are those who really need the separation, say for security reasons. For example, maybe you're a landlord and want you and your tenants isolated from each other. But no one should be doing this casually. Heck, I'm a software developer by trade, have dozens of machines here, desktops/laptops/servers, use multiple VPNs, bridges, APs, and have all kinds of complex setups to manage my workday, and even *I* don't have multiple networks!

So unless you can make a good case for multiple networks, get rid of them. Stick to the one off the primary router and only use bridged networking if you want add more routers, APs, switches, etc.

That said, I suspect the reason you're using a second network is because the DD-WRT PPTP VPN is only accessible over its WAN port, correct? FWIW, I've found dd-wrt's implementation of PPTP is not very reliable. You can find many threads on their forums about these PPTP problems. I personally have had similar problems and became so frustrated, I just decided to use a Microsoft PPTP VPN established on one of my servers. Works much better and doesn't require employing another network either (albeit, I have to have a computer running, but I'm almost always using the VPN to access a desktop/server anyway).

Thanks for the great response!

You are 100% correct - I am using the DD-WRT behind the AEX router purely because I can only use the WAN port for the PPTP VPN. And I use the AEX as the main router because my family can call Apple Support or go to the local store if they have any problems with the network while I am out of town, often for weeks.

My experience with DD-WRT PPTP VPN so far has been good, but ultimately I may move to OpenVPN. Small steps, and also I rarely need more than a stray file or two. It would be different if I needed to be online for long stretches.

And alas, I don't have any spare machines (Win or Mac) that I can leave online full-time and with a static IP.

So given all of that, I think I'm generally headed in the correct direction....

My thought about using sub-netting was related to the way *I think* this stuff works- that even if my DD-WRT is in the same range as the AEX, packets will not be sent out the WAN port to the AEX unless they pass the subnet mask math. Thus I need to arrange for a 4, 8, or 16 IP address range that corresponds both to the VPN IP range and also the proper mask. Again *I think* this will force all traffic outside that very short range of addresses to then go out the WAN port (example 10.0.1.1 VPN Client IP tries to contact 10.0.1.200).

Not sure if I'm articulating this properly, I hope so.

Thanks in advance to the community for advice!

reply to paolini
You're correct, you MUST in this particular case, use a different network (subnet) behind the dd-wrt router in order for routing to work properly. The fact that your current setup works at all suggests that it is configured properly. The inconsistency in accessing devices/services is harder to explain. As my first response suggests, I don't fully trust the dd-wrt pptp implementation, too finicky in my experience. Perhaps some tweaking is necessary, but I find the dd-wrt documentation somewhat "thin" in this regard.

OK, great. And again thanks for the quick response.

So here's where I get confused. I think the proper approach is:

AEX Time Machine (main router)
10.0.1.1 router address
DHCP with reservations limited to .50 and below
Fixed IP's in range .51-62
Subnet mask 255.255.255.0

DD-WRT (WAN port connected to AEX above)
10.0.1.193 router address
DHCP with reservations limited to range .194-249
PPTP VPN IP assignments in range 10.0.1.250-254
Subnet mask 255.255.255.192 (creates 4 networks, .1-62, .65-126, .129-190, and .193-254)

So everything in the 10.0.1.x range stays within the AEX LAN, all other traffic goes out the AEX WAN. And everything in the range 10.0.1.193-254 stays in the DD-WRT LAN, all other traffic (like static servers ending in .51-62) goes out the DD-WRT WAN port to the AEX.

Am I correct?

Is it also true that I can expand the AEX addressable range to 10.0.1.1-190 with the exception of .63, .64, .127, and .128? For example put DHCP in 10.0.1.1-.63 and fixed servers in 10.0.1.65-126?

It seems so easy until it doesn't.....

Again, thanks in advance!