So, I've been banging my head with this for quite some time.

I have the following configuration:

  • OpenVPN server, IP
  • Asterisk server, connected to OpenVPN server, IP
  • Raspberry PI, local interface, connected to OpenVPN IP
  • IP Telephone in the same local network as Raspberry PI, local ip

Networks are configured as follows:

  • Local connection on raspberry is eth0
  • Raspberry has additional virtual interface eth0:1 with ip
  • OpenVPN connection on raspberry is tun0
  • Telephone has local ip and gateway set to (raspberry)

On the raspberry, iptables is as follows:

#Empty all routing tables
sudo iptables -t nat -F
sudo iptables -F

#Masquerade all traffic leaving tun0 as if coming from
sudo iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

#redirect all traffic coming from eth0:1 to tun0
sudo iptables -A FORWARD -i eth0:1 -o tun0 -j ACCEPT

#redirect all traffic coming from tun0 to eth0:1
sudo iptables -A FORWARD -i tun0 -o eth0:1 -j ACCEPT

#Modify all packets coming to tun0 to forward then to the IP telephone
sudo iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination

So, I can call and I can receive calls (I have another laptop that is connected directly to VPN server and uses Zoiper for test). I can call the telephone and from telephone and audio from telephone to laptop works, but there is no incoming audio on the telephone whatsoever.

What am I doing wrong?


I also tried the following

  1. Phone has / settings, connected to raspberry which has / (raspberry ip is gateway to phone)

  2. Raspberry pi with tun ip (connected to wifi using wlan0, then to vpn).

  3. IPTables sudo iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT sudo iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT

  4. On VPN server (

route add

NOTE: iptables is without the masquerade. Now I managed to get traffic routed from -> (vpn server), but not the other way around.

Any ideas?

  • I'm not sure I understand exactly what you are saying works and doesn't work. If you can set up a call from the laptop to the telephone, then the network routing is probably OK. If the call sets up OK, but there is no audio, it might be that you have some filtering set up that allows the call set-up packets through, but not the message (does the VOIP software switch to a different port number?) Alternatively, there might just be a problem with your audio configuration on the laptop.
    – JRI
    Feb 13, 2018 at 23:53
  • TCP dump showed me that there is no incoming RTP traffic whatsoever, so I think I found the error, but not sure how to solve it. It seems that RTP initiation in itself contains the IP address of the sender (not in the packet header, but in the body), so when packet is being sent from telephone over raspberry to server, raspberry rewrites it as if it has came from raspberry, but inside the packet remains the original IP. So, now I am testing netsed to see if I can rewrite packets on the fly.
    – dkasipovic
    Feb 14, 2018 at 11:44
  • Can you add the subnet masks you used for the IP addresses configured? Feb 17, 2018 at 0:53
  • @Tim_Stewart
    – dkasipovic
    Feb 17, 2018 at 13:02

1 Answer 1


Is the masquerading a requirement? if not, as your phones have the Pi as their default gateway they can reach the Server with no additional effort, just make sure that the server can reach the phones back, add a route on the server (if necessary) for (adapt it as needed) via the Pi.

  • Yeah but given that VPN has dynamic IP, and that I will have multiple locations with PI which are not known in advance (at least at the moment), I am not really sure how to create routes on the server. Also, this really sounds like a workaround, not a solution that I would like to implement.
    – dkasipovic
    Feb 19, 2018 at 8:54
  • it is A solution to the problem not THE solution. If I understands what you want is take a pie configure it, and drop it somewhere and it works? As for the routes on the server if the pi is already the default gateway it should work out of the box. If not : ip route add via should do the trick (adjust the network address/mask to your needs). take look here : voip-info.org/wiki/view/NAT+and+VOIP Feb 20, 2018 at 0:45
  • So basically, what you are suggesting is, connect raspberry to vpn server, get IP A.B.C.D, then add that route on server so telephone ip (which is connected to raspberry), and then disable masquerade on the raspberry? That way, I will not need to modify the rtp packets, and the connected device will use it's original ip. The downside of this, if I am right, is that each raspberry should have different local IP range, so I can add multiple routes on the server.
    – dkasipovic
    Feb 20, 2018 at 9:27
  • In a nutshell, yes! the down side is as you mentioned. Feb 20, 2018 at 13:25
  • See the edit, if possible
    – dkasipovic
    Feb 22, 2018 at 22:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .