I've configured network shown in the following diagram:

enter image description here

ROT1 is Tomato-based router. It has BR0 bridged network interface for all the clients within internal network with subnet One of the clients is a NAS device (NAS01) which provides some basic services like ownCloud and SMB server. Both LAP01 and MOB01 clients are able to see NAS01 and use its services. ROT1 has also two VPNs configured: TAP0 is an OpenVPN bridged tunnel which is bridged with BR0, that's why client LAP04 receives IP address from DHCP server within subnet This client is also able to ping NAS01 device within internal subnet. Router ROT01 is running arpwake program to automatically wake up NAS01 with Magic Packet when the host is requested by some other client in the network with ARP request (who-has). You can find the description of the application and links for its source code here. arpwake application is listening on BR0 for ARP request containing MAC address of NAS01 and automatically sends Magic Packet if one of the clients within the network asks for it. The problem is that I'm trying to set up routed VPN tunnel also with OpenVPN that will allow me to use arpwake application in order to automatically wake NAS01 when one of the clients from TUN0 network will ask for it. If NAS01 is up I can ping it and use all the services, but if it's down I cannot wake it up with arpwake application, because there are no ARP requests on that interface (TUN0) - I've already checked that with tcpdump on the router. I've also tried to use Proxy ARP with command echo 1 > /proc/sys/net/ipv4/conf/all/proxy_arp but still it doesn't work.

Here's the configuration of the router:


Destination     Gateway         Genmask         Flags Metric Ref    Use Iface   *      UH    0      0        0 tun0     *      UH    0      0        0 vlan2   UG    0      0        0 tun0     *        U     0      0        0 br0     *        U     0      0        0 vlan2       *            U     0      0        0 lo
default         UG    0      0        0 vlan2

iptables (output of iptables-save concerning only TUN0)

# Generated by iptables-save v1.3.8 on Sun Aug 28 12:08:23 2016
:PREROUTING ACCEPT [50195:5904352]
:OUTPUT ACCEPT [4413:306096]
# Completed on Sun Aug 28 12:08:23 2016
# Generated by iptables-save v1.3.8 on Sun Aug 28 12:08:23 2016
:PREROUTING ACCEPT [1628436:1350223724]
:INPUT ACCEPT [43707:3160699]
:FORWARD ACCEPT [1563428:1344198921]
:OUTPUT ACCEPT [13790:1556262]
:POSTROUTING ACCEPT [1576178:1345632445]
# Completed on Sun Aug 28 12:08:23 2016
# Generated by iptables-save v1.3.8 on Sun Aug 28 12:08:23 2016
:INPUT DROP [10689:641141]
:OUTPUT ACCEPT [13539:1531250]
-A INPUT -i tun0 -j ACCEPT
# Completed on Sun Aug 28 12:08:23 2016

TUN0 OpenVPN config (security related options removed)

local [IP_address]
port [PORT]
proto udp
dev tun
push "route"
keepalive 10 120
push "dhcp-option DNS"

ifconfig for TUN0 interface (by default OpenVPN brings this interface up with NOARP option, but even if I turn this back on with command ifconfig tun0 arp it does not solve my problem).

tun0       Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
           inet addr:  P-t-P:  Mask:
           RX packets:311 errors:0 dropped:0 overruns:0 frame:0
           TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:100
           RX bytes:21166 (20.6 KiB)  TX bytes:3486 (3.4 KiB)

My question is: how to make this TUN0 interface to start working with ARP?

1 Answer 1


Non-IP traffic is not forwarded over Layer-3 (tun) interfaces, that's the whole beauty of it: you save on broadcast traffic and on ethernet headers. You can read about all of this on the OpenVPN wiki.

I am not sure I understand how arpwake works, the Web page you linked to is more of a ramble than a wiki. But you may try adding this firewall rule,

 iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE

This rewrites all source IP addresses, in the packet headers, with the router IP address. I do not know whether this will trigger arpwake, but you may try.


I have thought of a workaround, which does not use arpwake. Add the following iptables rule,

iptables -A INPUT -i tun0  -s xxx.xxx.xxx.xxx/24 -d -m state --state NEW -m state ! --state ESTABLISHED -j LOG --log-prefix "NEW_CONN_ATTEMPT"

where xxx.xxx.xxx.xxx/24 is VPN tunnel's network. Now setup an executable script, running under sudo, with the following content:

tail -f /var/log/firewall.log | awk '/NEW_CONN_ATTEMPT/ {system("/usr/local/bin/myscript")}'

where /usr/local/bin/myscript is a script that sends the magic packet to the NAS. It should work.

  • Hi, unfortunately this does not solve the problem, still there are no ARP requests, but I guess this is the specific of tun interface. Aug 28, 2016 at 14:04
  • @KrzysztofJakóbczyk Can you empty the arp cache (ip neigh flush dev br0) , then try connecting to the NAS via tun0? I do not understand why this does not work. I thought you would run arpwake on the ROT1 server, and that would make an ARP request for, which should be captured by arpwake and converted to a WOL magic packet. Can you also check that the ARP request from ROT1 is actually sent? Aug 28, 2016 at 17:00
  • I've done what you've suggested but still with no luck. arpwake in general is network sniffing tool that is looking for ARP requests comming from clients to ROT1 router. If it finds such request for MAC address passed trough command line option it will automatically send WOL packet to broadcast address of network in which the host resides (in general it always sends WOL to .255 of each subnet what doesn't have to be always the broadcast address, but it is in my case). If I check with tcpdump -i tun0 what happens on TUN0 interface I can only see IP transmissions, no ARP's. Aug 29, 2016 at 8:16
  • Also ICMP is working, but not ARP, however this is related, according to your answer, to TUN interfaces specific: they only work with IP-related traffic, that's why the TUN0 interface is being brought up with NOARP option and even turning it on does not allow me to see ARP traffic. If I use TAP interface instead of TUN the ARP requests are being captured with tcpdump -i br0 and this is when arpwake fires up booting NAS device with WOL. Aug 29, 2016 at 8:19
  • @KrzysztofJakóbczyk Ok, but what I am getting at is: why does not arpwake activate itself when the router sends out an ARP packet for the NAS? I was hoping arpwake would not be triggered only by outside ARP requests, but also the outer's itself. See wham I am hinting at? Aug 29, 2016 at 8:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .