I've been trying to figure out how to do this for awhile now and I'm not even sure if what I want to do is possible at this point. I'm trying to update and simplify my current network while maintaining it's existing functionality. I'm thinking maybe it's not even possible how I would like to set this up, or maybe there's a better way I'm not aware of - hoping someone could offer some clarity.
R1 has two networks configured based on the ports being used. R1 also has a VPN connection set up and routes all devices on the 192.168.15.0/24 network through the VPN. The 192.168.15.0/24 is completely segregated from the 192.168.0.0/24 network. R2 is configured purely as an access point and does no routing or anything else fancy. The remaining set up for the 192.168.0.0/24 network is pretty standard, no VPN or special traffic segregation etc (they still can't communicate to the 192.168.15.0 network to be clear).
Functionally I want to maintain the existing configuration if possible. My goal was that I would have the raspberry pi (with a connected USB to Ethernet adapter) encapsulate internet traffic on the 192.168.15.0/24 network to travel through the VPN. The existing segregation between 192.168.0.0 and 192.168.15.0 would remain.
I've tried adapting some of the existing guides online for creating a VPN access point with the raspberry pi, as well as the ones about using the pi as a router and can't seem to figure it out. R1 would remain as the DHCP server. S1 would actually be a layer 3 switch so it can potentially do VLAN's as well (if I understand correctly how layer 3 switches work anyways). I've also tried configuring the pi as a dhcp server only serving addresses out on the port facing Device Group 3, and it will hand the addresses out but then it can't route traffic back to S1 it seems. I've made sure packet forwarding is on, I've added / removed static routes on it to no avail.
Maybe I misunderstand and it's only possible to have the raspberry pi act like this when it's connected directly to the ISP modem? It's also completely possible I misconfigured something along the way too. If anyone could offer some guidance on if/how this could be possible I would greatly appreciate it!