Site-to-Site VPN - what hardware on each end?

RouterOS General
1

So I’m a bit paranoid about data backup and was thinking about setting up a site-to-site VPN between my house and a family’s house so that I can have my new server at my house (2TB and growing) and my old Synology NAS at the remote location for replication.

At my house I have a Mikrotik 450G. It is connected directly to my Cable modem and is the gateway for my home network. It gets a Dynamic IP address from the service provider, but I have a DYNDNS account and domain name.

At the other side, I was planning on hanging the VPN endpoint off their existing home network and only putting my devices behind the VPN so I don’t impact the setup of their network.

Configuration wise, I’ll be looking to have the remote end automatically connect and reconnect if it drops. It should essentially act as if it was a complete extension of my network.

What is the basic Mikrotik hardware that I’ll need for the remote end? Just another 450G?

Should I do any split tunneling to allow remote devices to get to the internet though the local or just forward everything to my network? I don’t plan on doing any browsing or anything like that from the remote side, just OS updates and e-mail notifications for the Synology.

If I’m missing anything, please feel free to clue me in.

Thanks!

2

Any of the 600MHz MIPSbe devices should work to be as fast as your RB450G. It may work with a slower device. You didn’t say how much bandwidth was available for the VPN. The 600MHz MIPSbe devices can probably move between 20 and 60Mbps of data in a VPN. It depends on the VPN technology.

I would try to make sure you have more than 32MB of RAM in the new device. It may not be necessary, but these devices are inexpensive. I would probably go with the 950/951 series over the 450G for lower cost and similar to better performance numbers, unless you want that serial port.

I would have the remote end on its own subnet. Then you don’t have to put up with broadcast traffic eating the VPN bandwidth.

You can specify routes to send the traffic between the subnets across the VPN. For the most part you won’t be able to tell they are not in your subnet.

Split tunnel is up to you. You will likely get better update download performance by letting the remote devices get their Internet from the remote router. It is entirely a personal choice.