I have a Debian 7 machine with an OpenVPN client and several services. The OpenVPN client does work as intended and all outgoing traffic from the Debian machine flows over the VPN connection (tun0). However, the local network connection (eth0) should be accepting connections for the services I run on the machine (e.g. a web server) and those should be accessible for local machines. How can I allow this?

eth0      Link encap:Ethernet  HWaddr 08:00:27:8f:6d:ce
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::a00:27ff:fe8f:6dce/64 Scope:Link
          RX packets:928 errors:0 dropped:0 overruns:0 frame:0
          TX packets:836 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:189364 (184.9 KiB)  TX bytes:118000 (115.2 KiB)

lo        Link encap:Local Loopback
          inet addr:  Mask:
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:  P-t-P:  Mask:
          RX packets:1 errors:0 dropped:0 overruns:0 frame:0
          TX packets:44 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:486
          RX bytes:107 (107.0 B)  TX bytes:3092 (3.0 KiB)

There are some requirements to your setup to accomplish this:

  1. Make sure that net.ipv4.ip_forward = 1 in /etc/sysctl.conf, this will allow traffic to pass through the OpenVPN box, making it work as a router.
  2. eth0 and tun0 are on different subnets. Make sure that your clients have a route towards the OpenVPN box for the VPN subnet, and make sure that your servers have a route towards their VPN interface for the client subnet.

This is not very easy to do right, so it might be easier to use a part of the subnet for your VPN, and use proxy-arp to handle the routing. You can find more about this in the OpenVPN Cookbook.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.