I have installed OpenVPN on a Raspberry PI (server: and on my Ubuntu laptop (client: Both machines are connected to the same wireless network and have their addresses assigned by DHCP from the wireless router at However, when the VPN is started, I cannot access the Internet from the client.

When I start OpenVPN on the server (with the following options), it appears to start correctly.

port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem
cipher AES-256-CBC
auth SHA512
topology subnet
push "dhcp-option DNS"
ifconfig-pool-persist ipp.txt
keepalive 10 120
status openvpn-status.log
verb 3

When I start OpenVPN on the client (with the following options), it too appears to start correctly.

ca keys/ca.crt
cert keys/client-no-pass.crt
key keys/client-no-pass.key
remote 1194
dev tun
redirect-gateway local
remote-cert-tls server
cipher AES-256-CBC
auth SHA512
proto udp
resolv-retry infinite
verb 3
mute 20

On the client, I can see that my IP routing table has been manipulated to use the server's VPN IP address as the default route, and that all traffic to the VPN network will be sourced with tun0's IP address of

me@client:~$ ip route
default via dev tun0 dev tun0  proto kernel  scope link  src dev wlp4s0  scope link  metric 1000 dev wlp4s0  proto kernel  scope link  src metric 600

When the VPN is disconnected, I can ping (a DNS server). When the VPN is connected, I cannot.

After searching Google, I tried adding this on the server, but it doesn't help:

sudo iptables -t nat -A POSTROUTING -s -o wlan0 -j SNAT --to-source

What am I doing wrong? How can I fix it? Is my local WLAN VPN scenario simply unsupported? I've tried running Wireshark to capture tun0 traffic from the client but haven't been able to resolve the issue.

EDIT: Additional information:

  1. The server's IP address was "reserved" (by MAC address) so that the router always assigns it the same address

  2. The server is configured (by way of editing /etc/sysctl.conf) to forward IPV4 packets, and this has been tested by running cat /proc/sys/net/ipv4/ip_forward (returns 1)

  3. The server routing table shows this:

me@server:~$ ip route
default via dev wlan0  metric 303 dev tun0  proto kernel  scope link  src dev wlan0  proto kernel  scope link  src  metric 303
  1. The server's firewall looks like this:
me@server:~ $ sudo iptables -S
-A FORWARD -s -i tun0 -o wlan0 -m conntrack --ctstate NEW -j ACCEPT

me@server:~ $ sudo iptables -t nat -S
  • Apart from the valid technical questions you asked. What is your end goal here? Obviously, if both machines are connected to the same network there is no need for a VPN tunnel between them. Is this just for testing? Jul 21, 2017 at 15:35
  • Yes, I am just trying to test OpenVPN on my LAN. I understand that there is no need for a VPN in this scenario, but I am also beginning to think that it might not be possible to run a VPN when both the server and client are already on the same network.
    – Jono
    Jul 22, 2017 at 6:10
  • I am not sure whether that's the reason, but usually NAT setups with iptables use -j MASQUERADE in the POSTROUTING rule. Jul 27, 2017 at 8:23
  • Nathan, on Liam's suggestion I modified iptables to use MASQUERADE (as shown in my latest edit of the question) but it still hasn't resolved the issue.
    – Jono
    Jul 28, 2017 at 9:20

1 Answer 1


You need to confirm that both routing and Network Address Translation (NAT) are working properly on your VPN server. Try using tcpdump to inspect the network traffic on the server's VPN interface and Ethernet port to make sure packets are flowing, and what their addresses are. To answer your comment on whether this can be done with this design, it certainly can, and is a great way to learn about all of the involved concepts.

Here is a good guide on NAT with Linux, and many others are available too. A key thing to check is whether your system is even correctly configured for routing - by default it may be turned off. If

cat /proc/sys/net/ipv4/ip_forward

returns a zero, then it's switched off and no firewall rules will save you. You can run echo 1 > /proc/sys/net/ipv4/ip_forward to turn it on, but rather look at the entire guide to get all the necessary steps completed as well as instructions for making this change permanent (it will be lost every time you reboot otherwise).

Also, if you are using DHCP for the VPN server, then you probably want to use MASQUERADE instead of SNAT, since the IP address may change and you firewall rule will then be incorrect.

Note that if you don't want to use NAT, you will need to let your local router (the one plugged into your ISP) know that your VPN subnet ( is behind your VPN server's IP address ( Right now, it has no idea how to find, so will simply discard the reply packets.

Again, if the server's address is assigned by DHCP then this could change and you would need to update the routing entry, and you may not even be able to add this route if you are using your ISP's router and they do not permit you to administer their device.

  • Thanks for letting me know it can be done. I've made an edit to the question to clarify that IPv4 forwarding is enabled, DHCP won't change the server's address, and shown the server's routing table. The one thing I don't grasp is how the router should ever need to know about the VPN addresses... I had expected OpenVPN server to handle the NAT on receiving packets from the public network and forwarding them to the clients on the private network. Perhaps your link will explain it - I'll start reading now.
    – Jono
    Jul 26, 2017 at 16:44
  • 1
    I found this link very helpful community.openvpn.net/openvpn/wiki/BridgingAndRouting as it instructed me on the correct FORWARD entries to be added to the VPN server
    – Jono
    Jul 28, 2017 at 16:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .