I'm trying to forward a port through OpenVPN (with Ethernet Bridging) but I can't.

Below is a "simple" network diagram. A server contains 2 virtual machines, the principal server is connected with OpenVPN to another server. I need forward a port from (a Virtual Machine) to public IP of the external server with IP (see diagram).

The bridge vmbr0 is including a three interfaces: tap0, eth0 (public IP) and vlan1 (

network diagram

The rule I used in server is

iptables -t nat -D PREROUTING -p tcp -d [public ip here] --dport 80 -j DNAT --to-destination

In the image below you can see that packets "enter" but not "exit" through the interface tap0.

This is a dump of tap0 interface:

principal server

The packets are entering correctly from tap0, but packets are routed to vmbr0 and never get to tap0.

How can I resolve this problem?

  • Port forwarding this way doesn’t work like you expect it to: Incoming it’s A -> B -> C, but outgoing it’s C -> A, because it’s reachable directly. However, A expects a response from B.
    – Daniel B
    Dec 26, 2015 at 19:39
  • Also, please provide the port forwarding rule as you added it via iptables(?).
    – Daniel B
    Dec 26, 2015 at 19:40
  • The rule added to iptables is iptables -t nat -D PREROUTING -p tcp -d [public ip here] --dport 80 -j DNAT --to-destination Dec 27, 2015 at 4:56
  • 1
    If you're ethernet bridging there shouldnt be any need to fwd...?
    – Linef4ult
    Dec 28, 2015 at 20:52
  • I need to be accessible from the public ip of the server Dec 28, 2015 at 21:20

1 Answer 1


Bridges essentially turn a number of NICs into a virtual switch.

If you want devices to talk across a bridge, they need to be on the same subnet, as they would on a real switch. If they are not on the same subnet, you need a router, not a switch or bridge.

So bridging your public IP eth0 and tap0 or vlan1 NICs won't work unless you have 2 public IPs from your ISP - allowing you to put both of them on the same subnet.

You can put both your virtual machines on a bridge - and they can talk since they'll be on the same subnet.

Your system then needs to route and do NAT, using eth0 as the "WAN" NIC and vmbr0 as the "LAN" NIC. Any guide you find on doing iptables with NAT can be used, just substitute vmbr0 for eth1 or the LAN-facing NIC.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .