In summary, I would like to have Tun device traffic forwarded back and forth through another network interface that has internet connection. While I can see the traffic going out to internet and coming back, it is not routed back to my Tun device.

Here's my setup:

I have a very simple setup using Mint Linux 15 VM under VirtualBox with Win7 as host.

Within the VM, there are two network interfaces - eth0 and tun0.

  • eth0 interface is connected to the internet, and is assigned as
  • tun0 interface is assigned as

    ip tuntap add dev tun0 mode tun user askldjd
    ip link set tun0 up
    ip addr add dev tun0

I set up my iptables rule to masquerade all traffic going out through eth0.

    iptables -I FORWARD -i tun0 -o eth0 -s -m conntrack --ctstate NEW -j ACCEPT
    iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE

I tested the rule using a simple ping -I. So to some degree, my iptable rules are working.

    ping -I google.com
    PING google.com ( from : 56(84) bytes of data.
    64 bytes from iad23s07-in-f1.1e100.net ( icmp_req=1 ttl=55 time=7.46 ms

My next step is to create a ICMP Request packet with src =, and dst = (google.com). This was done through a tcpdump capture, so I know the packet fields/checksum are all valid. And I am sending this packet out to a raw IP socket using a very simple Python script.

Before I run the python script, I set up tshark to monitor eth0 and tun0.

    tshark -i eth0
    tshark -i tun0

Then I run the script. From the tshark console, I can see the ICMP Request going out, and ICMP Reply coming back from google.

    1811.947250 -> ICMP 98 Echo (ping) request  id=0x0990, seq=1/256, ttl=64
    1811.955146 -> ICMP 98 Echo (ping) reply    id=0x0990, seq=1/256, ttl=55

And from the tun0 tshark window, I see nothing.

In my mind, since the ICMP Request packet is set as source =, I would expect that the IPTable to un-nat the ICMP Reply when it comes back. This is not happening.

So either my IPTables setup is incorrect, or I am simply misunderstanding the concept of the Tun device. Any guidance would be greatly appreciated.

I apologize if I misuse any terminology. I am a novice when it comes with networking.

migrated from serverfault.com Nov 25 '13 at 7:39

This question came from our site for system and network administrators.


Your main mistake is: assumption that such kind of traffic will be forwarded. This is not that case. This is outgoing, not forwarded traffic for VM perspective. ICMP replies come to eth0 and go up to protocol stack, thus, you can not see them on tun0 device. For futher details you can look here: https://serverfault.com/questions/554477/tap0-not-receiving-traffic/554698

  • Do you have any suggestion to make that kind of traffic to be treated as "forwarded", instead of "outgoing"? – ram Dec 26 '17 at 5:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.