Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup my own little access point and I've got two core elements of it working.

  1. The WiFi Access point is connectible. I can access a webserver on the router
  2. SSH-ing into the router, I can connect to the outside internet via PPTP

Does anyone know of any way I can connect the two elements together?

share|improve this question
up vote 2 down vote accepted

First you need to enable IP forwarding:

echo 1 > /proc/sys/net/ipv4/ip_forward

Then presuming that your VPN assigns a static IP you'll need SNAT:

iptables -t nat -A POSTROUTING -o <TUNNEL INTERFACE> -j SNAT --to-source <VPN IP>

replacing and as appropriate ofc. If your VPN gives you a dynamic IP, you'll need to use MASQUERADE instead:


Then check that your routing table is correct with:

route -n

check that you have a line similar to this:         <VPN ENDPOINT IP>         UG    2      0        0 <VPN INTERFACE>

if it's missing, add it:

route add default gw <VPN ENDPOINT IP> dev <VPN INTERFACE>

Each distro has it's own methods of making these changes permenant/persistant, so I'd need more info to help in that regards.

share|improve this answer
I am using a debian on a raspberry Pi. I'm able to send packets as running tcpdump on ppp0 shows: 12:03:48.687991 IP > 10290+ A? (37) – Joe Simpson Oct 3 '13 at 12:05
Oh wait, I can access Google via ip address over the network now, but dns isn't working at all – Joe Simpson Oct 3 '13 at 12:26
You'll need to be more specific, DNS isn't working from where? What's the content of the pi's /etc/resolv.conf? the clients's /etc/resolv.conf? what's the pi's routing table? is /proc/sys/net/ipv4/ip_forward set to 1, etc etc – Nanzikambe Oct 3 '13 at 15:45
Yeah. I can access Google direct via ip address and dns works fine from the pi itself. Dns simply isn't working from a computer on the network – Joe Simpson Oct 3 '13 at 15:46
After doing a random test on changing DNS servers, it seemed by Uni VPN blocked any DNS that wasn't going to their DNS servers. Thanks anyway :) – Joe Simpson Oct 4 '13 at 19:32

After having installed pptpd and struggling to have my VPN connection forward any traffic when connected. I used the iptables rules from below and it worked perfectly! I didn't need LAN access in neither way so I didn't use those but the VPN Client <-> World helped a lot.

I'm sharing the rules here if someone wants them.

 # Allow traffic initiated from VPN to access LAN
iptables -I FORWARD -i ppp* -o eth0 \
     -s -d \
     -m conntrack --ctstate NEW -j ACCEPT

# Allow traffic initiated from VPN to access "the world"
iptables -I FORWARD -i ppp* -o eth1 \
     -s -m conntrack --ctstate NEW -j ACCEPT

# Allow traffic initiated from LAN to access "the world"
iptables -I FORWARD -i eth0 -o eth1 \
     -s -m conntrack --ctstate NEW -j ACCEPT

# Allow established traffic to pass back and forth
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED \
     -j ACCEPT

# Notice that -I is used, so when listing it (iptables -vxnL) it
# will be reversed.  This is intentional in this demonstration.

# Masquerade traffic from VPN to "the world" -- done in the nat table
iptables -t nat -I POSTROUTING -o eth1 \
      -s -j MASQUERADE

# Masquerade traffic from LAN to "the world"
iptables -t nat -I POSTROUTING -o eth1 \
      -s -j MASQUERADE

Of course, I assume you have already done

echo 1 > /proc/sys/net/ipv4/ip_forward
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.