I'm not exactly sure what the goal is for what you are trying to accomplish. You could have a network on eth2 that uses policy based routing to send traffic to a VPN (must be VTI, openvpn, etc. with a routeable interface). I'm not sure what you mean by "lantolan vpn". If you are just looking to only allow certain devices to connect to the other subnet you could accomplish this with firewall rules.
↧