VPN without NAT

[Stephen Becker]

I have two houses that each have ASUS routers and I want to make both LANs routeable. The concept is this, setup a tunnel between the routers, add a static route on each router pointing to the other's LAN network, using it's tunnel IP as a gateway. I work with Cisco routers a lot and such a setup would be easy as cake on them.

The two issues I ran into using the factory firmware are
--No way to statically set the tunnel IP address of the client router
--The client router seems to use NAT to access the tunnel, I don't want NAT, I want direct routing

Does the Merlin firmware allow me to make those two changes I would need to make (statically set the client VPN's IP address and disable NAT for the tunnel)?

I read that Merlin adds IPsec support, which would be the easiest, but I don't have static IP addresses and you can't add hostnames to a routing table. Instead I was hoping to use OpenVPN to establish a GRE-like tunnel via DNS lookup, so I can put the virtual tunnel addresses in the routing tables.

 

[Stephen Becker]

UPDATE: I updated one router to Merlin and it looks like it will do what I need. I see the Advanced VPN client options now gives you a way to disable NAT. I don't see a way to set a static IP address, but there are "Custom Configuration" blocks on server and client side, so there is probably a way to do it (I believe it would need to be server side because I think OpenVPN does not allow a client to specify its own IP address).

 

[RMerlin]

If you use a different Common Name for each client, you can also enable the server option to provide client-specific configuration. This allows you to assign a static IP to a given common name, if I remember correctly (I never really looked at that functionality).

 

[web]

How can i change the common name for the clients?

 

[RMerlin]

How can i change the common name for the clients?

You have to generate client certificates with different CNs.

 

[web]

You have to generate client certificates with different CNs.

That i understand. But how to generate certificates that work with the asus router? i really have no clue

 

[RMerlin]

Use this as a starting point. "client1" would be the CN.