I have an OpenVPN server on my vps running. Now I want to forward some specific ports to my clients. I have already added some rules to my iptableswithout any success. Maybe someone can have a look.


IP - Forwarding is already enabled

sysctl -w net.ipv4.ip_forward=1


  • Sureley there’s no need to censor the addresses because they’re supposed to be VPN-internal. – Daniel B Mar 28 '17 at 9:22

Ok I know what was wrong:

  • I had more than one VPNClient with the same IPAddress. So I gave each of them a static IPAddress

Define a directory where the client scripts should be stored , e.g. /etc/openvpn/staticclients and create the directory

mkdir /etc/openvpn/staticclients

Add this directory as option to your openvpn configfile at the server:

client-config-dir /etc/openvpn/staticclients

For each client you have to create a file. The filename must match the common name attribute that was specified at the certificate of the client. This command gets the CN from the computers certificate:

This example pushs the IPAddress to the Client with the common name TESTCLIENT and also pushes a additional route for subnet

cat /etc/openvpn/staticclients/TESTCLIENT

push "route"
sysctl -w net.ipv4.ip_forward=1

iptables -t nat -A PREROUTING -p tcp --dport 28006 -j DNAT --to
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.