Involved Devices: a VPS, a router, and several devices that connected to the router.

Final Aim: Base on the OpenVPN client which has connected to the server on the VPS, specify only one local device to access the Internet through the VPN, and forward some ports of the VPS to the specified device.

VPS Network:

Public IP: 157.7.201.X

Router Network:



VPS: (static)
Client: (static)

The IP of the specified device is (static)

(You can jump over the following detailed configurations to see my situation now directly, because it's a little long and not all the lines are useful.)

And here's the iptables of my VPS:

root@VPS:~# iptables -t nat -L POSTROUTING -vn
Chain POSTROUTING (policy ACCEPT 24 packets, 2860 bytes)
pkts bytes target prot opt in out source destination
6280 663K SNAT all -- * * to:157.7.201.X

The route table of my router:

root@Onee3:/tmp/home/root# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface * UH 0 0 0 vlan1 UGH 0 0 0 vlan1 * UH 0 0 0 tun11 UG 0 0 0 tun11 * U 0 0 0 vlan1 * U 0 0 0 br0 * U 0 0 0 lo
default UG 0 0 0 vlan1

The iptables of my router:

root@Onee3:/tmp/home/root# iptables -t nat -L POSTROUTING -vn
Chain POSTROUTING (policy ACCEPT 5 packets, 709 bytes)
pkts bytes target prot opt in out source destination
75 14012 SNAT all -- * br0 to:
12828 1438K SNAT all -- * vlan1 to:
27 1764 SNAT all -- * tun11 to:
33 1980 SNAT all -- * vlan1 to:
0 0 SNAT all -- * tun11 to:

My situation now is:

Router itself can access the Internet via the physical network, and it can access any host including, which is the virtual IP of the VPS.

Any device connected to the router can access the router and the virtual IP of VPS normally. Devices included in the iptables of the router which are set to use vlan1 can access the Internet normally, for example, in the list. Others not included can't because the default MASQUERADE record was deleted manually.

So now I have added a record into the iptables of the router to do an ip forward from to by SNAT(in the list above) or MASQUERADE(also tried), but the result is that can only access the hosts in LAN or the virtual IP of the VPS.

In one word, I'm now being stuck on my halfway(or even less) to the final aim. Please help me, thanks.


It seems that the problem really has none business with pre-routing or post-routing

I finally solved the problem by adding a new route table

route add default gw # to add a default route of the local physical network, notice that it should be above the one of the VPN
ip route del default via dev tun11 table main # delete the VPN route from the main route table
ip route add table 200 via dev tun11 # create a new table numbered 200 to use the VPN
ip rule add from table 200 # add devices which are expected to be connected to the VPN
ip rule add from table 200

Then for the port forwarding, I referred https://unix.stackexchange.com/questions/55791/port-forward-to-vpn-client

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.