When connecting to our company's VPN and looking at the routing table I find this:     UG    0      0        0 tun0 UH    0      0        0 tun0   UG    0      0        0 tun0

I think I understand the first line to be: A packet to the 172.16 network is dropped into the tun0 interface, but addressed to the gateway which will take care of the rest.

The second line says explicitly that to get to, just drop it into tun0.

What I don't understand is why the last two lines cannot just be combined into   UG    0      0        0 tun0

to say that anything to 10.8 can just be dropped into the tunnel and the right machine will pick it up. Why must a packet to 10.8 first be explicitly handed over to the gateway of that same network? Is it that the is kind of misused as a switch here, because it is actually the only machine directly connected to the other end of tun0 and knows ways how to move packets onwards for 10.8?


Before answering this questions let me explain the flags which are linked.

  • U (route is up)
  • H (target is a host)
  • G (use gateway)

Route 2 and 3 cannot be combined because you are informing the source machine to reach directly (metric 0) and to reach any machine with the network ID please use the gateway I am not sure why are we forwarding pkts to default gateway but this might be the trick to inject reverse route on the gateway router / firewall.

  • Does this not violate the expectation that a network like is like a physical connection between all hosts on this network. In former times it was one physical BNC cable. Today we have switches. Targeting the gateway on the same networks seems like making up for a missing switch, and it would mean the would have to have two interfaces both for the network and it does actually more switching than routing? If I want to address, say, whether the endpoint *241 places it on the "wire" ore my machine should be the same --- or not? – Harald Apr 20 '16 at 11:30

At a guess the topology of the network would be

Client => Internet => =>

When the VPN is established you can't directly connect to any host but the VPN endpoint via tun0. To send data to anything else in the range you need to send it to the GW ( which would then forward it on to the correct host.

This could be to give you an IP on the same network as the servers at the remote endpoint or so you can connect to other VPN clients.

  • How can it be that hosts on the 10.8. are not reached when I drop a packet into the tun0 interface. Is this not switching by routing then? – Harald Apr 20 '16 at 11:56
  • If the host does definitely exist then it could be being blocked by the VPN endpoint. – Jonathan Widdicombe May 12 '16 at 10:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.