I recently set up my Raspberry Pi as a network bridge to my home network using Open VPN. The goal was to allow co-workers access to a storage device on my LAN.

I'm using the Open VPN Cloud. So I'm not running my own access server. I can't install new software on the storage device without voiding its warranty.

So instead of installing Open VPN's Access Server, I created a new "Network" in the cloud dashboard as well as a new subnet and connected my Raspberry PI as the network "Connector".

After that, I set up the PI to route packets to and from Open VPN's network interface using nftables:

sudo nft add table nat
sudo nft 'add chain nat postrouting { type nat hook postrouting priority 100; }'
sudo nft 'add chain nat prerouting { type nat hook prerouting priority -100; }'
# When destination IP is (Cloud IP for network device), route packets to LAN storage device
sudo nft add rule nat prerouting iif tun0 ip daddr dnat
sudo nft add rule nat postrouting masquerade

Description: When destination IP is (Cloud IP for network device), route packets to LAN storage device. It also enables NAT.

My question is this. When a client is signed into the cloud, how does their Network Interface know to route traffic for my custom subnet IP range?

I checked Open VPN's network interface on my Windows computer and noticed that my subnet was not assigned to it. Yet, I'm able to connect to my subnet IP range ( when I'm signed into the cloud.

I know my subnet is technically just a single IP, but that's all I needed in this case.

Does Open VPN automatically configure the client to route packets in a similar way to how I set up the PI to route packets between interfaces? E.g Maybe OpenvVPN configured the client device to route packets for a specific subnet into their own network interface, which then routed packets to my PI's interface. Is that how this works?

I'm also probably a bit confused because I don't understand IP routing very much on Windows at all.

1 Answer 1


Routing on Windows is not much different from routing on Linux.

It isn't limited to just "local subnet & default gateway" – you can configure, or the OpenVPN client can install, routes for arbitrary network prefixes.

If you run route -4 print you'll most likely see a route for the prefix through the VPN tunnel interface.

  • Thanks for your response! You are right, I'm able to see how packets are getting routed for my subnet via route -4 print. I've accepted this as the answer, thanks again!
    – Charles
    Mar 7, 2021 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.