Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I occasionally connect to the internet using public wifi networks at coffee shops and the airport. I know they are not secure networks and I'd like to ensure that when I am on them all my traffic is routed through a secure connection.

I have a Windows 7 x64 machine which I'm trying to setup as an OpenVPN 2.1.3 server. I have successfully configured it and can establish a connection using the client on a different computer.

When connecting from the client I'd like to have all the traffic routed through the OpenVPN server. When I enable the push "redirect-gateway def1" option I can not connect to any sites using the client. The documentation states that if I am using Linux I'd need enable NAT using iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE Unfortunately I'm not using Linux (though if I have to I'll set his up on a linux VM).

How do I configure OpenVPN and Windows so that the redirect-gateway works? Here is my OpenVPN Server config:

port 443
proto udp
dev tun

ca C:/PROGRA~2/OpenVPN/easy-rsa/keys/ca.crt
cert C:/PROGRA~2/OpenVPN/easy-rsa/keys/server.crt
key C:/PROGRA~2/OpenVPN/easy-rsa/keys/server.key  # This file should be kept secret

dh C:/PROGRA~2/OpenVPN/easy-rsa/keys/dh1024.pem


ifconfig-pool-persist ipp.txt

push "redirect-gateway def1"

push "dhcp-option DNS"

keepalive 10 120



status openvpn-status.log

verb 3



share|improve this question

I believe the Windows terminology for "IP packet forwarding with MASQUERADE/SNAT" is "Internet Connection Sharing". Configure ICS on your Windows 7 x64 box, and you should then be able to see the internet from your VPN client.

share|improve this answer
Thanks. I looked at that an not sure which device do I setup for ICS. I have a LAN ( and OpenVPN network ( – Martin Giffy D'Souza Oct 30 '10 at 19:47
Set up the LAN connection (192.168.x.x) for ICS. It looks like your server is itself behind a NAT router. Is this correct? – Steven Monday Oct 30 '10 at 20:32
I setup ICS for the LAN to the OpenVPN Network and no difference. I also enabled the services. – Martin Giffy D'Souza Oct 31 '10 at 20:43
Yes the LAN is behind a NAT router. – Martin Giffy D'Souza Oct 31 '10 at 20:44
So your VPN client will be accessing the internet via double NAT, since the ICS server is also serving as a NAT router. This is not optimal, but it should work okay for web browsing. Now to troubleshoot. From the VPN client, are you able to ping the server's LAN interface? How about the NAT router's LAN interface? How about the NAT router's internet interface? On the ICS server, what is the output of route print? – Steven Monday Nov 1 '10 at 0:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.