Two Asus RT-AC68U routers with Merlin software, connected via VPN - dhcp problem.

[bartasmosina]

Hello I have a small problem with connecting two routers via VPN. One of them is located at my house and the other at a friend's house. We both have a fiber connection with a public ip.
The colleague rents his house to other people and for security purposes he has surveillance installed there with IP cameras. The cameras cover the area around the house, but recently his DVR crashed.

I have a spare rejstrator at home so I made my Asus router as the client and his as the server. After setting up a VPN connection, I connected the DVR to my router but it could not see the cameras. When I changed the settings in the DVR from automatic dhcp to manual ip and entered an ip address from the class of those that are at my friend's house, everything started to work as expected.

After a few days, however, I noticed a problem that sometimes the devices in my house connected to my router get the ip from my colleague's dhcp and the internet does not work on them. In the status tab you can see that all ip addresses from my friend's network have been assigned, except for the default gateway. In VPN settings I have it set to work as Lan Only. Do you know what could be the reason for this behavior that sometimes I get ip not from my router?

Configuration:
My router ip 192.168.2.1 dhcp 192.168.2.2-200 mask 255.255.255.0
A colleague's router ip 192.168.3.1 dhcp 192.168.3.2-200 mask 255.255.255.0
We both use the ddns service from asus and have our own domains.
We both have the latest available version of merlin software installed

 

[ColinTaylor]

Can you confirm that your VPN connection is using TUN and not TAP?

 

[bartasmosina]

This is our setup

 

[ColinTaylor]

That will be your problem. You're using a bridged connection (TAP) when you should be using a routed connection (TUN).

 

[bartasmosina]

That will be your problem. You're using a bridged connection (TAP) when you should be using a routed connection (TUN).

Sorry to write back so late, but I only found time today to test the change in settings. It works after changing from TAP to TUN the problems disappeared. At first the DVR lost connection to the cameras even though it had the same ip class as the cameras. When I changed its ip to my local connection to the cameras came back on its own. Now the DVR connected to my router has ip 192.168.2.250, and the 4 cameras connected to the router at a friend's house have ip addresses 192.168.3.251 *252 *253 and *254 and everything works without any problems and additional combinations with changing ip classes to manual settings.

I see you have a lot of knowledge about VPN connections, I have to test each setting until I can achieve what I need.

If it's not a problem I would like to ask one more help how to set up VPN connections

It is known that each ASUS RT AC68U has 2 VPN servers and 2 customer profiles
I have a total of 5 friends who have identical routers with merlin and we have common interests regarding e.g. projects on raspberry and anything related to ip access. We would like to create a VPN connection between our routers so that everyone being in their home having a computer connected to their router can access devices in another location on it. Is such a thing possible? Each router in a different location has a different ip class and dhcp: 192.168.1.1, 192.168.2.1, 192.168.3.1, 192.168.4.1,192.168.5.1

For connections between routers we would use SERVER 1 and CLIENT1 + CLIENT2
Server 2 would be useful for vpn connections of phones and computers when we will be in other locations and want to connect to our network.
In the TAP connection when I connected my computer to my home from another location it had the same ip address as in my home network and thanks to that my NAS was able to backup from it as if I was at home. Unfortunately through TUN this function doesn't seem to work. On the other hand through TAP the vpn connection on the phones didn't work, but on TUN it works without any problem.

Can you suggest how to solve this so that everything works?

 

[DocUmibozu]

Sorry to write back so late, but I only found time today to test the change in settings. It works after changing from TAP to TUN the problems disappeared. At first the DVR lost connection to the cameras even though it had the same ip class as the cameras. When I changed its ip to my local connection to the cameras came back on its own. Now the DVR connected to my router has ip 192.168.2.250, and the 4 cameras connected to the router at a friend's house have ip addresses 192.168.3.251 *252 *253 and *254 and everything works without any problems and additional combinations with changing ip classes to manual settings.

I see you have a lot of knowledge about VPN connections, I have to test each setting until I can achieve what I need.

If it's not a problem I would like to ask one more help how to set up VPN connections

It is known that each ASUS RT AC68U has 2 VPN servers and 2 customer profiles
I have a total of 5 friends who have identical routers with merlin and we have common interests regarding e.g. projects on raspberry and anything related to ip access. We would like to create a VPN connection between our routers so that everyone being in their home having a computer connected to their router can access devices in another location on it. Is such a thing possible? Each router in a different location has a different ip class and dhcp: 192.168.1.1, 192.168.2.1, 192.168.3.1, 192.168.4.1,192.168.5.1

For connections between routers we would use SERVER 1 and CLIENT1 + CLIENT2
Server 2 would be useful for vpn connections of phones and computers when we will be in other locations and want to connect to our network.
In the TAP connection when I connected my computer to my home from another location it had the same ip address as in my home network and thanks to that my NAS was able to backup from it as if I was at home. Unfortunately through TUN this function doesn't seem to work. On the other hand through TAP the vpn connection on the phones didn't work, but on TUN it works without any problem.

Can you suggest how to solve this so that everything works?

Searching on the forum, you can find old posts that explain how to block intersite DHCP queries in a tap ovpn connection.
One Is this:

How to block DHCP protocol over a TAP site-to-site VPN (useful if you host separate DHCP subnet ranges at each site as part of a superset subnet)

Crafted for an Asus router with Merlin firmware. Enable SSH access to your router (administration/system) **I don't recommend exposing SSH access to the internet unless you are really comfortable with the risk. Enable JFFS custom scripts in router (admin/system page) This example is...

www.snbforums.com