How to connect a branch office to the main network via VPN?

Question

VPN

I need to make VPN access to the branch network. I will use GRE over IPSec on Mikrotik. There are routers, I raised the tunnel for the test.
The question is more theoretical.
Let's say the LAN address at the main office is 192.168.1.0/24. Is it possible to set the local network address in the branch to 192.168.1.0? Or is it necessary to use another one, for example 192.168.2.0? If it is possible, then how to register a route on a branch router (it's better to have an example of a command for RouterOS right away)? He already has one directly connected to 192.168.1.0, and then a second one appears, accessible through the tunnel.

Another interesting thing is that it is written about GRE that it passes broadcast traffic. Does this mean that the hosts on the branch and main networks will act as if they are on the same L2 network? Let's say the host from the branch has the address 192.168.1.10, and the server from the main network 192.168.1.254. Will the remote host get an IP address from a DHCP server on the main network, log in to a domain controller, and so on?

Answer 1

> Whether it is possible to set the address of a local area network in branch 192.168.1.0?
It is possible if there are special reasons for that, some special software that cannot work differently. But normal people don't do that.
Each branch must have its own network.
> how to set a route on the
MK1 router
/ip route add distance=1 dst-address=192.168.1.0/24 gateway=gre-office (VPN interface name)
MK2
/ip route add distance=1 dst-address=192.168.2.0/24 gateway=gre-branch (VPN interface name)
> Another interesting thing is that GRE says that it allows broadcast traffic.
broadcast traffic works within the L2 network. When you raise a VPN, you get 3 (three) L2 networks. Accordingly, broadcasting can work within each L2 network, but broadcasting does not get into another L2 network by itself, this requires appropriate settings.
L2 - branch
L2 - office
L2 - VPN
> Does this mean that the hosts in the branch and the main network will act as if they are on the same network?
If you correctly register the routes, then the hosts will work within the same L3 network and can easily see each other.
> Whether the remote host will receive an IP address from a DHCP server on the main network.
This requires BRIDGE and usually use EoIP, but I do not recommend doing this unless absolutely necessary. Just think about it, if you run one DHCP for two offices, it will turn out that the branch goes to the Internet through the main office VPN. Don't you think it's a crazy overhead?

Answer 2

Is it possible to set the local network address in the branch to 192.168.1.0?

Can. But not necessary. The only reason I know when they are trying to stretch the network to L2 is the presence of software with artifacts, for example, searching for a computer purely by Netbios name (which does not work through anything, but only works within the L2 network). Trying to simplify administration for oneself will lead to its fantastic complication.
The usual scheme for building a VPN is a center to which remote nodes connect. Routing is carried out by the center. The center has its own subnet, the nodes have their own - each node has its own. dhcp is distributed by the node (theoretically, dhcp can be forwarded using dhcp realy, but reliability suffers noticeably - the tunnel has fallen - the network has disappeared in the branch). The local DNS is distributed by the center, although with a decent load on the node, a slave server is usually installed on the node, on which duplicate services are raised - dns, ad, etc. - so that the user does not run for authentication for every sneeze to the center.

Answer 3

Is it possible to set the local network address in the branch to 192.168.1.0?

Here it is better to start with a fundamental solution to the second problem. I don't know the answer to it.
But if you want to combine networks into one, then of course the branch office must use the same subnet as the head office. But in my opinion this is a bad idea.
So it's better not to merge networks (in the sense of answering the second question) and use routing instead of a bridge.
This means that if you use the same subnet in the branch network, you will get a lot of routing problems that will have to be solved somehow.
To basically avoid problems - use a different subnet.