跨国办公跨地域网络访问需求的最优解决方案咨询

Hey James,

First off, let's start by addressing your OpenVPN hiccup briefly—since it worked initially but stopped after a few days, common culprits are usually dynamic IP changes on either end (if you don't have static public IPs), expired certificates, or accidentally tweaked firewall rules. But you're spot-on that a permanent LAN-to-LAN IPSec VPN is a far better fit for your use case, especially since you need consistent, hassle-free access to remote bank accounts and local services for your team.

Here's a breakdown of the best solutions tailored to your DrayTek Vigor 2866ax routers:

1. IPSec LAN-to-LAN VPN (Top Recommendation) #

Your DrayTek Vigor 2866ax fully supports IPSec LAN-to-LAN tunnels, which is perfect for your scenario because:

• It creates an always-on, seamless connection between the two office networks. No more manual VPN client setups for every device—users can access remote resources like they're on the same physical LAN.
• It's far more stable and secure for long-term, continuous use compared to client-based VPNs like OpenVPN, especially when multiple devices need access.
• You can customize routing to send only necessary traffic (like bank service requests) through the tunnel, or route all internet traffic from one office through the other's network if that's what you need.

Quick Setup Tips for DrayTek IPSec: #

• Static IPs or DDNS: If either office doesn't have a static public IP, set up DDNS on both routers (DrayTek has built-in support for most major providers) so the tunnel can reliably find the remote end.
• Avoid Subnet Overlaps: Make sure your two office LAN subnets don't clash (e.g., use 192.168.1.0/24 for one, 192.168.2.0/24 for the other) to prevent routing conflicts.
• Policy-Based Routing: Tweak the router settings to direct only traffic destined for the remote office's services through the tunnel if you want local users to keep using their own internet for general browsing.

2. DrayTek Smart VPN (Simpler Alternative) #

If you find IPSec setup a bit technical, DrayTek's Smart VPN is a great shortcut—it uses IPSec under the hood but comes with a wizard-based setup specifically for DrayTek-to-DrayTek LAN-to-LAN connections. It cuts down on configuration time and reduces the chance of setup errors.

3. Fixing Your Original OpenVPN (For Individual Device Access) #

If you still need client-based access for remote workers not in the office, here's how to troubleshoot the sudden failure:

• Check if the remote router's public IP changed—if so, update the OpenVPN client config with the new IP, or switch to using a DDNS hostname instead of a static IP.
• Verify the OpenVPN server certificate on the router hasn't expired (you can check this in the router's VPN settings under Certificate Management).
• Ensure firewall rules on both routers still allow OpenVPN traffic (UDP port 1194 by default) to pass through.
• Try restarting the OpenVPN server service on the router and reconnecting the client.

Final Call #

Go with the IPSec LAN-to-LAN VPN for your core office-to-office connectivity—it's the most reliable, scalable solution for your needs. If you have occasional remote users, keep the OpenVPN client setup alongside it for individual device access.

备注：内容来源于stack exchange，提问作者James Lee