Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an OpenVPN server and a client, and I want to use this tunnel to access not only but the whole internet. So far, pinging the server from the client through the tun0 interface works, and vice versa.

However, pinging from the client through tun0 doesn’t work (all packets are lost).

I figured that I should configure the server so that any packet coming from tun0 in destination of the internet be forwarded, so I came up with this iptables config line:

internet_ip_address=`ifconfig "$interface_connecting_to_the_internet" | sed -n s'/.*inet \([0-9.]*\).*/\1/p'`

iptables -t nat -A POSTROUTING -o "${interface_connecting_to_the_internet}" -j SNAT --to-source "${internet_ip_address}"
echo '1' > /proc/sys/net/ipv4/ip_forward

Yet, this doesn’t work, the packets are still lost and I am wondering what could possibly be wrong with my setup.

Some details:

ip route gives on the server:

default via dev eth0  metric 3 via dev tun0 dev tun0  proto kernel  scope link  src via dev lo dev eth0  proto kernel  scope link  src 

ip route gives on the client:

default via dev wlan0  proto static via dev tun0 dev tun0  proto kernel  scope link  src via dev lo  scope link dev wlan0  proto kernel  scope link  src 

  • client uses wifi adapter wlan0 and TUN adapter tun0.
  • server uses ethernet adapter eth0 and TUN adapter tun0.
  • the VPN spans on

  • both client and linux are using Linux 3.6.1.

share|improve this question
It probably would be helpful if you could elaborate on the OS used on the client and the routes defined on both the server and the client (the output of ‘ip route’ should do in the case of Linux). – Claudius Nov 3 '12 at 21:55
@Claudius here you go! – qdii Nov 3 '12 at 22:03
I assume that you have tried turning off iptables to eliminate that as the cause? – Julian Knight Nov 3 '12 at 22:04
@JulianKnight I normally don’t use iptables, I just added the rule to see if it would help. So my first configuration did not use iptables. – qdii Nov 3 '12 at 22:08
I take it you did not enable the push "redirect-gateway def1" option on the OpenVPN server? As of now, the routes on the client direct it to use as the default gateway. To change that, you would have to add a specific route to your server via the current default gateway, then delete the default route and set a new one via your server (or, alternatively, use the option mentioned above). – Claudius Nov 3 '12 at 22:08
up vote 1 down vote accepted

To sum up the discussion:

In order to reach a specific host A through a VPN from client C to server S, one has to:

  • enable ip forwarding on S (sysctl -w net.ipv4.ip_forward=1)
  • enable either masquerading or snat via iptables on S: iptables -t nat -A POSTROUTING -o ext_if -j MASQUERADE or iptables -t nat -A POSTROUTING -o ext_if-j SNAT --to-source ext_ip with the obvious meaning of ext_if and ext_ip.
  • set up appropriate routing on C, either (S denotes S’ IP address in the VPN):
    • by setting an explicit route to A via S: ip route add A via S dev vpn_if
    • by setting a default route via S: ip route add default via S dev vpn_if, where one also has to set an appropriate route to S: ip route add S via previous_gateway dev prev_if.
    • by using the push "redirect-gateway def1" on the server, in which case OpenVPN will set up routes to and on C via S, which are more specific than the default route and can easily be removed when the tunnel is stopped.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.