[eddybear]

Has anyone managed to get this working? There is an Avaya PBX at 192.168.25.10 with vlan100 and I am trying to use a remote site (which is working fine via routed OpenVPN) as 192.168.35.0/23. All computers are working fine, I can ping the address of the Call Server but the phone cannot register.

I switch the phone to vlan1, it gets the HTTP 200 OK but cannot connect to call server, I am wondering if I need to configure a split subnet say 192.168.36.0/24 with vlan100 and the 192.168.35.0/24 for the computers using the default vlan.

1. How do I create a vlan100? is it as simple as "ifconfig br0:100 192.168.36.1 netmask 255.255.255.0 promisc up" or is there more to it ?

2. If not, how do I set a virtual interface with the 192.168.36.1 IP to route tagged packets properly with vlan 100 so that communication works with the call server - I think this is essentially the problem?

I'm not even sure if this will fix the problem but it's the only thing i haven't tried and yes the DHCP has option 176 and 242 configured properly with MCIPADD and so on and the phones and server are working at another site that is *NOT* using the routed vpn/ddwrt setup.

[eddybear]

I think the issue I am having is somehow linked to these 2 lines I have on the Main (Hub) Router:

iptables -I FORWARD -j ACCEPT
iptables -t nat -A POSTROUTING -j MASQUERADE

With the "nat" line in there is no issue, I can route properly back and forth throughout the network, if I remove it all traceroutes stop at the tunnel IP of the Main Router.

I believe the IP packets are being manipulated which is causing the error whereas a true VLAN between Cisco routers without NAT'ing offers proper routing.

Question is, how do I remove that line and still have the tunnel function?

[Per Yngve Berg]

Limit the NAT to the WAN port.

iptables -t nat -A POSTROUTING -o `get_wanface`-j MASQUERADE

The remote router (where the PBX are) must have a route the the network on the other side. This can be pushed with OpenVPN.

You need 3 networks Local, Remote and the Tunnel.

1. VLAN is only for wired ports connected to a switch.

2. To have the same ip subnet on both sides, a Bridged VPN must be used (TAP, not TUN Interface)