I'm trying to figure out how to route OpenVPN clients without using NAT/PAT. What I want to do is to route the IP address that they are assigned when clients authenticate to the OpenVPN server to the network (in the server.conf file). My OpenVPN server is directly connected to my gateway. I don't want it masquerading, as that makes it hard to track down individual clients by IP and causes other issues. I'm sure it's probably something that I need to do in iptables, but I'm at a loss for how to do it. Any help would be appreciated.

OP clarifies

"I want the IP that the server.conf is giving out to the clients to traverse the inside of my network - I might have confused some by suggesting that I don't want that IP address to work...if so I apologize. What I want is to not have to PAT between the tun0 interface and the inside interface of my OpenVPN server. I want each client to have their own IP address inside the network, not the IP address of the inside interface of the server."

added by barlop

Here is a diagram

enter image description here

  • I'm no expert, but isn't the point of a VPN that it's private, and part of the way it's private is by using a private IP range doing NAPT(NAT/PAT).. You may be right that it's possible but could you elaborate perhaps.. i'm curious. You may be right.. and the way it's private has nothing to do with NAT/PAT blocking incoming, but is done by firewall blocking incoming..
    – barlop
    Aug 20, 2015 at 21:18
  • Why don't you try it.. The VPN server could give out public IP addresses. Then see if the computer given a public IP address by the VPN, is (via that IP) inaccessible by any computer not connected to the VPN.. But if you do that, i'm not sure if it's really a public IP.. You could try it then connect from computer A inside th VPN to a computer (B) you control that is outside the VPN, and see at B, what the source IP is.
    – barlop
    Aug 20, 2015 at 21:23
  • I'm not trying to re-route to the internet or anything like that. I have a scope of user IP addresses (lets say That can pass through my network to the resources that the clients are allowed to access (lets say on the network). I'm trying to use that range of user IP address inside of my network to access internal resources (the VPN does not redirect out to the internet). The OpenVPN server is not my gateway - I want to push all the traffic coming into the OpenVPN server to my gateway, without the NAT/PAT going on. Make sense?
    – jjmil03
    Aug 20, 2015 at 21:38
  • no I don't understand, I don't understand what "pass through my network" means, and I don't understand what "resources that the clients are allowed to access" means. And I don't know whether you are calling 10 your network or 192 your network.. or both.
    – barlop
    Aug 20, 2015 at 21:41
  • I'd note though that my notion of VPNs was incorrect.. They don't block incoming at all. They can work without NAT as well. They just allow a computer to connect remotely, joining the subnet of the other computers on the VPN. The privacy is the encryption.
    – barlop
    Aug 20, 2015 at 21:42

1 Answer 1


OpenVPN server will function perfectly with or without NAT/PAT. The problem lies with the machines receiving the packets from subnet; they do not know how to reply to as they do not have a route for it (and each machine software firewall may also need to allow the subnet specifically). Add a static route on the destination machines for the subnet.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .