I have a Raspberry pi with Debian wheezy. There are three connections exists:

eth0: native usb ethernet, connected to the router.
eth1: plug-in usb ethernet adapter
tun0: tunnel created by openconnect vpn client

Now, I want to create a bridge between eth1 and tun0, so that all the traffic from eth1 are routed to the VPN. There is no application running on the OS needs the VPN connection.

  |  OS Local --> eth0 --|--> router
  |                      |
  |   Debian Wheezy      |
  |                      |
--|--> eth1 --> tun0 ----|--> vpn server

I did some research and it turns out that tun0 is a layer 3 device while eth1 is a layer 2 device. They can't talk to each other directly. The first thing come to my mind is if I can create a tun1 from eth1 and connect tun1 and tun0. But is it possible? How can I do this?

Any ideas? Thanks.

UPDATE: Current route table after vpn connected:

default dev tun0  scope link 
default via dev eth0  metric 202 via dev eth0  src dev tun0  scope link dev eth0  proto kernel  scope link  src  metric 202 
  • Do you really need this??? Please post your routing table, sudo ip route show. Jun 28, 2015 at 11:19
  • @MariusMatutiae route table posted.
    – De Gao
    Jul 8, 2015 at 17:37
  • @MariusMatutiae sorry but where can I find the answer?
    – De Gao
    Jul 12, 2015 at 10:43
  • I have just published my answer to your query, please come see it. Jul 14, 2015 at 17:32

2 Answers 2


You need to implement policy routing, which means having two routing tables. We shall not touch the main routing table which is already correctly setup. If you have enabled IPv4 forwarding, it will automatically push the packets from eth1 through your OpenVPN.

First, we need to learn how your OpenVP sets up the routing table. To this, end, start the OpenVPN client from the command line:

    sudo openvpn --config YourConfigFile.conf

(or YourConfigFile.ovpn, whichever you use). The last lines will tell you how it sets up the new routing table, for instance in my case it says:

Tue Jul 14 18:58:07 2015 /sbin/ip route add My.Server.Public.IPaddress/32 via

Tue Jul 14 18:58:07 2015 /sbin/ip route add via

Tue Jul 14 18:58:07 2015 /sbin/ip route add via

Tue Jul 14 18:58:07 2015 /sbin/ip route add via

Tue Jul 14 18:58:07 2015 /sbin/ip route add via

Tue Jul 14 18:58:07 2015 Initialization Sequence Completed

The routes above should be introduced into an executable file, except that some of these numbers are peculiar to this particular instance of the VPN. OpenVPN however provides useful environmental variables which will hold the values of the interfaces used above, and which come in very handy: in this specific case, they are

      route_net_gateway ->
      route_vpn_gateway -> 

Thus the lines you need to add to a file (let's call it /etc/openvpn/route_up.sh) are:

 /sbin/ip route add Your.OpenVPN.Server.IPAddress/32 via $route_net_gateway table vpn
 /sbin/ip route add via $route_vpn_gateway table vpn
 /sbin/ip route add via $route_vpn_gateway table vpn
 /sbin/ip route add Remote.LAN.Net/24 via $route_vpn_gateway table vpn
 /sbin/ip route add via $route_vpn_gateway table vpn

Remember to substitute, in the above, the IP address of your remote server, and of its local LAN if you use it; if you are just using the OpenVPN to obtain an IP of your server, then you do not need the next to the last statement at all. Remember to make the file executable, chmod 700 route_up.sh.

Also, you will also have to create a new file, /etc/openvpn/route_down.sh, also executable, which tears down exactly the same routes (just change add to del).

Now we need to tell your OpenVPN to avoid implementing the routes, because we will do this manually: in your YourConfigFile.conf, add the following lines:

        up /etc/openvpn/route_up.sh
        down /etc/openvpn/route_down.sh

Lastly, we need to setup the different routing table for the VPN. Add a new routing table, let's call it vpn:

       echo 200 vpn >> /etc/iproute2/rt_tables 

Now we introduce a rule:

     ip rule add from table vpn

where I assumed that the network behind eth1 is, if it is not please change accordingly.

Lastly, you will have to introduce a MASQUERADE iptables rule:

      iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

This is it.

  • @MariusMatutiae: I would love clarification on Your.OpenVPN:server.IPAddress and Remote.LAN.Net. the first is "public ip" of server? and what is the other? Thanks! Feb 1, 2018 at 23:48
  • @LennartRolland 1): Yes. 2): It is the LAN in which the OpenVPN server is immersed, sometimes you want to have access to it. For instance, suppose you have setup an OpenVPN server at home, and you connect to it when you are away. Then you will certainly want to connect to your OpenVPN server and to its LAN (which appears as remote to you, when you are away from home). If instead you are using an OpenVPN server provided by a commercial enterprise, for instance to allow you to bypass geo-restrictions, then you have no interest to contact the LAN in which the server resides. Feb 2, 2018 at 7:20
  • @MariusMatutiae: Thank you that cleared it up perfectly! Feb 4, 2018 at 17:45

If I understand correctly you are trying to make a dual ethernet VPN passthrough, which the data comes in through eth1, and eth0 connects to the router (outbound to the Internet).

You can use iptables to redirect your eth1 traffic to tun0:

sudo iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
sudo iptables -A FORWARD -i tun0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i eth1 -o tun0 -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.