Häufig gestellte Fragen

Normally, you cannot reach networks over VPN whose addresses overlap with the local network.

Resolve Network Conflicts using Traffic Control

With VPN Tracker, you can use Traffic Control to send network traffic to non-critical local addresses over the VPN (Advanced > Traffic Control > Send local network traffic over the VPN if remote networks conflict with local networks).

Please note that you will never be able to reach the following addresses over VPN: The address used by your local router, the DHCP server address, the DNS server address(es). If you want to reach these IPs over VPN, you must resolve the network conflict manually instead of using Traffic Control. The same applies to all IPs that you need to reach locally and over the VPN.

Resolve Network Conflicts Manually

Basically, there are two ways to resolve a network conflict:

1. Change the local network to use different addresses: In most cases, this means changing the LAN settings on the local router (including DHCP settings if DHCP is used). Also, the IP addresses of the devices on the LAN must be changed (or a refresh of the DHCP addresses triggered in the case of DHCP).
2. Change the remote network to use different addresses: In most cases, this means changing the LAN on the VPN gateway (including DHCP settings if DHCP is used). Also, the IP addresses of the devices on the VPN gateway's LAN must be changed (or a refresh of the DHCP addresses triggered in the case of DHCP). If the LAN was used in the VPN settings (e.g. policies, firewall rules), it must also be changed there. Finally, please change the remote network in VPN Tracker accordingly.

If you decide to change the remote network, it makes sense to use one of the less commonly used private subnets for the new network. According to our experience, these are the following networks:

• Subnets of 172.16.0.0/12
• Subnets of 192.168.0.0/16, but not 192.168.0.0/24, 192.168.1.0/24 and 192.168.168.0/24

If you cannot use any of these networks, you can of course also use a subnet of 10.0.0.0/8, but without 10.0.0.0/24, 10.0.1.0/24, 10.1.0.0/24, 10.1.1.0/24. However, some WLAN and mobile network operators use the entire 10.0.0.0/8 network, so the above networks are preferred to subnets of 10.0.0.0/8.

If you use a VPN gateway with more extensive settings options (e.g. a SonicWALL), you may be able to set up an alternative remote network that is mapped 1:1 to the actual remote network using Network Address Translation (NAT). VPN users can then connect to this alternative remote network instead if the normal remote network causes conflicts. For SonicWALL devices, you can find a description of such a setup here.

If the conflict is caused by virtual network adapters (e.g. Parallels, VMware), you can find more information here.