Best way to connect two sites via VPN

VPN Forum
1

Hello!

Here’s my situation: I have two sites (mine and my parents’ houses). Each private network is sitting behind an RPi4 acting as a gateway/router and I’ve allocated them 10.0.10.0/24 and 10.0.20.0/24 respectively. Each router has a single external IP address allocated by the ISP which we can assume is static for now.

What I would like (ideally) is a seamless way to route from one private subnet to the other over the Internet. So, for example, if I’m on 10.0.10.75 and ping 10.0.20.86 something like this happens:

10.0.10.75 -> 10.0.10.1 (priv) / 56.123.45.60 (pub) (router A)
           -> encapsulated packet over public internet
           -> 10.0.20.1 (priv) / 78.987.65.40 (pub) (router B)
           -> 10.0.20.86

where all the heavy lifting of routing and encapsulation etc is done by the routers, without me having to set up VPN connections individually on each computer in each network. I assume each router will also need to share routing tables with each other via an encapsulated BGP connection or something too.

Is there a ready made solution that already exists that does this; some software I can install from apt on both routers and just do some config and go? Or alternatively is there a way to put together something that works using standard networking tools?

(Also, obviously the IPs aren’t actually static but I have domains pointing to them that I can keep updated with the correct IP.)

Apologies if this isn’t the right place for this but it seemed more right than /r/HomeNetworking.

2

https://www.smallnetbuilder.com/archives/security/security-howto/30353-how-to-set-up-a-site-to-site-vpn-with-openvpn?start=0

​

I followed similar instructions, but have a tunnel like this right now.

3

Have you looked at ZeroTier? https://www.zerotier.com/

You can have all the machines on a secure network.

4

I have a similar setup with my parents, we use OpenVPN and IPsec site-to-site VPN and route the networks to each other. I used no IP and domain name verification to handle not having a static IP.

There are lots of other guides around for pfSense and help out there, many other routers support IPsec VPNs though so guides would be slightly translatable.

I would however ask do you actually want *all* of the devices reachable both sides or only some? Might having some firewall rules in place help so that you only access the devices from each side that you need to.

5

IPSec Site-to-Site was made for this.

Otherwise create a GRE tunnel and route the traffic over the GRE interface IPs…

This has been around forever… Pick your flavour of VPN, they can all do site-to-site…

6

I work for them, so don’t hate, but this is literally what it’s made for

7

def don’t want your parents accidentally browsing your media server…