Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a peculiar problem with a OpenVPN tunnel on my Linux-server (RoadWarrior config). I can login perfectly with Tunnelblick 3.0 on my Mac, I can access all services on the server hosting the OpenVPN daemon, however, I am unable to access any other machine on the server's subnet.

I am pushing the route to the client and netstat -rn shows that the route exists.

My client-config is as following

port 500
dev tun
remote {secret} 

ca ca.crt
cert client.crt
key client.key



verb 4

and the server's configuration is following

port 500
dev tun


ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh1024.pem

mode server



push "route"
push "route"


keepalive 10 60
inactive 600

user vpndaemon
group vpndaemon


verb 4

I can't find any obvious mistake and I also verified that there are no IP clashes on the client-side.

Any hints or ideas are greatly appreciated!

share|improve this question

migrated from Aug 18 '10 at 19:51

This question came from our site for professional and enthusiast programmers.

up vote 1 down vote accepted

You probably need to setup your Firewall to do MASQ for your VPN IP addresses.


in your iptables config should do the trick.

share|improve this answer
My server is behind an existing firewall that also performs NAT and as such, IPTABLES is turned off on the server. Is this a requirement? – SiCN Aug 19 '10 at 7:15
If you plan on routing packets through your VPN Server to other servers on the network, you'll need a method to do that. IPTables is not the only, but perhaps the simplest method of accomplishing this. Also -- Just because your server is protected from the world, doesn't necessarily mean its a great idea to turn off iptables. Just my 2c. – GruffTech Aug 19 '10 at 15:13

And you need to enable kernel IP packet forwarding (routing between tun interfaces and eth):

uncomment or insert the following line in your /etc/sysctl.conf:


and run:

sudo sysctl -p
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.