Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I a have a number of servers which expose various public services to the web. These are behind a server which is acting as a firewall using IPTables and forwards traffic to and from the servers. All of the servers have a public IP, for example in the range 1.2.3.x.

I've set up a VPN using PPTD to the firewall server. This connects with a local IP range in the 192.168.0.x range. I can connect and SSH to the local machine. However when I use the public IP of one of the other servers, this routes via the internet and not the VPN.

How can I make the VPN server accept and route traffic on behalf of the other servers when connected?

share|improve this question
Why their public IP? You should be using their private IP if you are accessing over a VPN. – Paul Nov 15 '11 at 11:13
up vote 1 down vote accepted

You probably mean 'PPTP' VPN.

This type of VPN works by creating a virtual network adapter on the client side. Any network adapter, virtual or not, can/will have routing table entries and this controls where traffic goes.

All outgoing traffic is checked against the routing table. Routing table entries with higher or more specific subnet masks are chosen to send traffic through before ones with lower or less specific subnet masks. The subnet mask of 192.168.0.X is, or /24. The default gateway, which collects all traffic not picked up by anything else, has a "subnet mask" of, or /0.

By virtue of assigning an IP address and subnet mask to an adapter, you automatically get a free route. Let's say your home router gives one of your adapters an IP address of, and a subnet mask of (which equals /16). This inherently means that any traffic that goes out of that adapter can reach anywhere on 10.1.X.X. So a route table entry is generated to that effect. Outgoing traffic is checked against the routing table and if it's going to somewhere else in 10.1.X.X, it will NOT go through your default gateway which is a /0.

Hopefully by now, you can see that if you are sending traffic to an IP not within by your VPN adapter's subnet, it's going to go through the default gateway and therefore through the whole Internet.

Really the only way to accomplish what you are trying to do is:

  • Configure the VPN on the server side to tell clients to use the VPN adapter as the default gateway. This will cause all client traffic to go through your VPN.
  • Configure the VPN on the server side to tell clients to use a server within the VPN for DNS
  • Configure some IPTables firewall rules that will catch outgoing traffic on the public IP's of your servers and redirect them to the appropriate VPN-reachable IPs. If clients are using your VPN as the default gateway you might not really need to do this, but it would ensure no traffic leaks outside of your VPN if clients are only trying to reach internal addresses.
  • You also can run a separate DNS server, or a separate DNS domain, that is reachable only within the VPN and that resolves names for clients on the VPN, to internal VPN addresses instead of public IP addresses.

Another side note: VERY BAD IDEA to use 192.168.0.X, or 192.168.1.X for a company VPN - because this might conflict with common IP ranges setup for home routers. You should change it to something uncommonly used at home like 192.168.88.X.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .