Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two linux servers say X and Y. There is a VPN connectivity between the two, such that X can connect Y through some ports(e.g. 22,5901 etc) but Y can not connect X. internet is available on X.

I want to access internet on server Y. How can I do that?

share|improve this question
If there is VPN connectivity, surely machine Y must already have Internet connectivity and its a matter of firewalling ? – davidgo Feb 14 '13 at 8:45
I want to use internet of X on Y using tunneling/proxy. A simple list of commands will be helpful – Suresh Kumar Feb 14 '13 at 9:20

This is non-trivial and you have not provided anything like enough details for an exact solution, but, in general terms the steps you need to take are:

  1. Set up a default gateway on Y through X, without breaking the VPN connection. This is probably a matter of adding a specific route for the VPN endpoint/subnet, and changing the default gateway on X.

  2. The firewall (if one exists) on Y needs to be modified to allow traffic to and from X.

  3. packet forwarding needs to be enabled on (echo 1 > /proc/sys/net/ipv4/ip_forward) should generally work.

  4. You need to set up masquerading / NAT on server Y to rewrite the packets leaving it. This will depend on your interfaces, but something like /sbin/iptables -t nat -A POSTROUTING -o (Ext IF on Y, eg eth0) -j MASQUERADE will usually work.

  5. You may need to add MTU clamping if some sites work but others don't. Something like iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

Note that depending on your Internet requirements you might not actually need any of this - you may be able to use SSH to create a SOCKS proxy and simply use that (but that will only work if the Internet clients you are using on X support SOCKS). This is an order of magnitude easier to do for a one off if you can get away with it though.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.