Business Community > Gateways > Split Tunnel (standalone, IPSec, 1 WAN Interface each)
< Gateways

Split Tunnel (standalone, IPSec, 1 WAN Interface each)

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

Split Tunnel (standalone, IPSec, 1 WAN Interface each)

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Split Tunnel (standalone, IPSec, 1 WAN Interface each)
Split Tunnel (standalone, IPSec, 1 WAN Interface each)
2025-02-11 21:49:39 - last edited 2025-02-14 00:30:47
Tags: #VLAN & Multi-Networks #VPN #WAN Setup #Routing
Model: ER7206 (TL-ER7206)  
Hardware Version: V2
Firmware Version:

Hello, I have 2 ER7206, and I will set up an IPSec tunnel between the two. These are standalone routers....no controllers.

 

There is one physical WAN cable from the provider on each side. On the branch side there is 1 public IP, and I have 4 public IPs on the HQ side.

 

 

Using the VPN confogu document, I will configure the IPSec tunnel.

 

My main question is that I want HQ PC at 192.168.20.3 to ONLY go out to the internet....NEVER through the VPN or back to the Branch...at all.

 

How can I accomplish this? VLAN? NAT? what routing? This is my first go at this, and, unfortunately, this is not a lab setup, this is something I need for my actual work. Thanks

  0      
 
  0      
 
#1
Options
1 Accepted Solution
Re:Split Tunnel (standalone, IPSec, 1 WAN Interface each)-Solution
2025-02-12 05:44:21 - last edited 2025-02-14 00:30:47

Hi @PBInc 

Thanks for posting in our business forum.

PBInc wrote

  @Clive_A 

Thanks for your reply.

 

You are right that it is the same vlan.

 

Yes, I want to exclude HQ PC from the vpn, and want to make sure that it only accesses the local ISP.

 

What if I speciy a vlan 30, for example, with 192.168.30.0/24 and give that HQ PC an IP of 192.168.30.3, assign vlan 30 to port 6 on the router. How would I set it up so that that particular PC sends no traffic to the tunnel, AND only accesses internet through the local ISP.?

 

Thank you again for guiding a newbie to this setup.

 

 

Yes. That's how I imagine it would work for your requirements.

Just don't pick VLAN 30 in the IPsec VPN and it will be excluded.

Recommended Solution
  1  
  1  
#4
Options
6 Reply
Re:Split Tunnel (standalone, IPSec, 1 WAN Interface each)
2025-02-12 02:34:40

Hi @PBInc 

Thanks for posting in our business forum.

IPsec does not route the Internet. So, it does not go to the branch for the Internet. Unless you are trying to access the branch local IPs.

 

Do you mean that you want to exclude 192.168.20.3 entirely from the VPN tunnel that links the branch?

That is basically impossible to do as it is a computer in the VLAN where you specify in the IPsec Site-to-Site.

You can set up ACL to block others from accessing it.

  1  
  1  
#2
Options
Re:Split Tunnel (standalone, IPSec, 1 WAN Interface each)
2025-02-12 03:41:21

  @Clive_A 

Thanks for your reply.

 

You are right that it is the same vlan.

 

Yes, I want to exclude HQ PC from the vpn, and want to make sure that it only accesses the local ISP.

 

What if I speciy a vlan 30, for example, with 192.168.30.0/24 and give that HQ PC an IP of 192.168.30.3, assign vlan 30 to port 6 on the router. How would I set it up so that that particular PC sends no traffic to the tunnel, AND only accesses internet through the local ISP.?

 

Thank you again for guiding a newbie to this setup.

 

 

  0  
  0  
#3
Options
Re:Split Tunnel (standalone, IPSec, 1 WAN Interface each)-Solution
2025-02-12 05:44:21 - last edited 2025-02-14 00:30:47

Hi @PBInc 

Thanks for posting in our business forum.

PBInc wrote

  @Clive_A 

Thanks for your reply.

 

You are right that it is the same vlan.

 

Yes, I want to exclude HQ PC from the vpn, and want to make sure that it only accesses the local ISP.

 

What if I speciy a vlan 30, for example, with 192.168.30.0/24 and give that HQ PC an IP of 192.168.30.3, assign vlan 30 to port 6 on the router. How would I set it up so that that particular PC sends no traffic to the tunnel, AND only accesses internet through the local ISP.?

 

Thank you again for guiding a newbie to this setup.

 

 

Yes. That's how I imagine it would work for your requirements.

Just don't pick VLAN 30 in the IPsec VPN and it will be excluded.

Recommended Solution
  1  
  1  
#4
Options
Re:Split Tunnel (standalone, IPSec, 1 WAN Interface each)
2025-02-12 16:20:48

  @Clive_A 

 

I am attaching an updated diagram

 

VLANs 20 and 30 have been created in HQ, and I have created "pretend" public ip addresses of 80.x and 90.x

 

You said to not pick vlan 30 in ipsec...I have not created an IPSec tunnel yet, so don't know about that....but is there an option to pick which vlans are accessible and which are sent over the IPSec tunnel?

 

Thanks in advance.

 

  0  
  0  
#5
Options
Re:Split Tunnel (standalone, IPSec, 1 WAN Interface each)
2025-02-13 00:32:13 - last edited 2025-02-13 00:58:28

Hi @PBInc 

Thanks for posting in our business forum.

PBInc wrote

  @Clive_A 

 

I am attaching an updated diagram

 

VLANs 20 and 30 have been created in HQ, and I have created "pretend" public ip addresses of 80.x and 90.x

 

You said to not pick vlan 30 in ipsec...I have not created an IPSec tunnel yet, so don't know about that....but is there an option to pick which vlans are accessible and which are sent over the IPSec tunnel?

 

Thanks in advance.

 

 

  2  
  2  
#6
Options
Re:Split Tunnel (standalone, IPSec, 1 WAN Interface each)
2025-02-13 12:42:21

  @Clive_A 

 

This is most helpful, thank you.

 

I have finally got both routers, and both side public IPs. I will set this up over the next few days and update this thread / you.

 

Have a great day.

  1  
  1  
#7
Options

Information

Helpful: 0

Views: 529

Replies: 6

Tags

VLAN & Multi-Networks VPN WAN Setup Routing
About Us
Press
Copyright © TP-Link Systems Inc. All rights reserved.