I have setup a PPTP server on a CentOS 6 box.
Several clients (Windows and Linux) connect to this server.
All clients use the same subnet.
All clients (Win or Lin) can surf the Internet using the VPN successfully.
Windows clients can ping any other Windows client (XP/Vista/7) connected to VPN.
Linux clients (KVPNC) can ping any Windows client (XP/Vista/7) connected to VPN.

So far so good. But there's this weird problem and I've been trying to figure it out with no luck:
No client can ping (reach) a Linux client (successfully) connected to VPN. And yes, the firewall is completely disabled.

I'd really appreciate any hint/idea. TIA,

EDIT: The ultimate goal of this is to share services across the VPN, like accessing a HTTPD running on a Linux box from a Windows client.

  • Is ping response enabled on the Linux clients, i.e. what is the output of sysctl net.ipv4.icmp_echo_ignore_all? – lupincho Dec 8 '12 at 18:51
  • @lupincho net.ipv4.icmp_echo_ignore_all = 0 As you may have guessed my main goal is to able to reach some services (like httpd or Tomcat) running on Linux box across the VPN. So the ping problem just denotes that the Linux boxes are not reachable at all. – Bahman M. Dec 9 '12 at 4:35

On the VPN SERVER, following need to be done:

Enable tcp/ip forwarding

Linux TCP/IP stack by default does not forward packets (either between interfaces or re-routing them between IP network). It has to be enabled

echo 1 > /proc/sys/net/ipv4/ip_forward

Without that, VPN server will accept VPN client packet locally, and route client packet according to NAT rule, but will not route traffic to local network, which include other vPN client.


Iptables block all traffic by default. You need rules to allow traffic to get through.


Change to match your vpn network ip addresses. That will allow traffic between your vpn network machines.


When vpn client need to talk to each together, the vpn server is acting as a routing point and need to be on the same netowrk.


Modify the above according to your network setup.

  • Thanks but I don't get the iptables part. Do you mean I should add that FORWARD rule on the server or on Linux clients? – Bahman M. Dec 11 '12 at 8:56
  • yes, you can try it from commsnd promt 1st. – John Siu Dec 11 '12 at 13:17
  • Oops! My mistake! It didn't work :-S I added the rule to client iptables and it's still the same. – Bahman M. Dec 11 '12 at 15:24
  • Both tcp/ip forward and iptables rule are to be applied on the vpn server, not the client. – John Siu Dec 11 '12 at 15:36
  • Thanks for your response. Applied to no avail which makes sense as if the problem was in forwarding, Windows clients shouldn't have been reachable as well while they are. – Bahman M. Dec 11 '12 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.