Second router as VPN gateway

[rmon]

I would like to connect only a few devices on my network to a VPN. My Asus router allows either all devices to connect to the VPN, or none.
I can't use the Merlin or DD-WRT firmwares because I am using aimesh.

Can I use a spare Asus router as a VPN Gateway? I am planning to use it as the default gateway only for those devices that I want to connect to the VPN.

I can't figure out how to configure the IP addresses so that the VPN gateway can be reached by the same subnet of my main router, but uses this main router to connect to the Internet.
Basically it would need to use the same subnet both on the LAN and on the WAN side for the VPN gateway.

Is this possible?

Thanks for helping

 

[ColinTaylor]

Merlin's firmware supports AiMesh and policy routing.

 

[eibgrad]

Basically it would need to use the same subnet both on the LAN and on the WAN side for the VPN gateway.

Is this possible?

Thanks for helping

This makes no sense. BY DEFINITION, when you have a WAN and LAN, you have a routing configuration, which mean the two sides necessarily must have different IP networks (subnets), which is why you need the routing in the first place . If the two sides share the same network, then they are necessarily SWITCHED, not routed.

What you can do is use a secondary router as a VPN gateway by patching its LAN side to the existing LAN, having it connect to a VPN server over the WAN of the primary router, then configuring select LAN clients to use it (instead of their default gateway on the primary router) as their gateway. IOW, those clients always use the VPN router as their gateway, which in turn routes them over the primary router's WAN. The best way to handle it is to configure exceptions in DHCP (via DNSMasq) to give those clients the VPN router's IP address instead of the primary router as thei default gateway. In some cases, you could also statically configure clients, but that's often impossible (e.g., mobile devices), or impractical.

One additional change I would make it to NAT those same clients of the VPN router over to the primary router so that they send their replies back to it, which then returns those replies to the client. If you don't, then the replies from the primary router will bypass the VPN router completely. And while it will still work, you'll end up w/ lots of dangling connections on the VPN router (which eventually will timeout). It's just cleaner to avoid that by NATing the traffic as comes into the VPN router and is sent over to the primary router.