Here's my scenario:

I have a VPS that has two IP addresses and is running OpenVPN (IP Address of OpenVPN server: I want to forward all received traffic on ONE address to VPN-client (

Here are the two rules I am CURRENTLY using:

iptables -t nat -A PREROUTING -i venet0 -p ALL -d <EXTERNAL IP #1> -j DNAT --to-destination
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

This works. I can forward the request to the VPN-client and consume the services that are hosted by the VPN-client. However, I have another service that needs to know the TRUE IP address of the INCOMING-CLIENT's request. When I do it the above-mentioned way, the VPN-client thinks the incoming-client has an IP address of, which is the IP address of the OpenVPN server.

I've tried many solutions, including replacing the MASQUERADE with...

iptables -t nat -A POSTROUING -o tun0 -s -j SNAT --to-source <EXTERNAL IP #1>

but that doesn't work. All requests just hang.

My networking architecture is only using the venet0 and the tun0, which is the OpenVPN tunnel. Suggestions as to how to get the TRUE IP address of the public-client would be greatly appreciated. Thank you.



It looks like you should be using neither SNAT nor MASQUERADE. Either option will result in double NAT preventing both ends from knowing the real IP of the other end. NAT will always break this knowledge in at least one direction.

If the server at the other end of tun0 uses your router for its default route, it should return traffic back to your router where the DNAT can be undone for the return traffic.

An alternate option, at least for HTTP, is to run a proxy on your server. The proxy should add or extent the X-Forwarded-For header. This will contain one or more addresses identifying the address for which the traffic has been forwarded for. You can trust the IP address you add. Other addresses could be spoofed.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.