Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to create a LAN to LAN VPN using OpenVPN and two RHEL5 machines. I have everything working, except that it fails after I reboot the client side(until I restart iptables).

The relevant openvpn configuration:

dev tun
proto tcp-client
remote 443
secret static.key

The relevant iptables configuration:

-A POSTROUTING -o tun0 -s -d -j SNAT --to-source

I think it has something to do with iptables coming up before OpenVPN, and not being able to SNAT to an IP that it doesn't have yet. How can I get this to work after a reboot without having to restart iptables?

share|improve this question

Your system does it start iptables at boot ? If not, ask it, in /etc/rcS.d or something like that (it depends of your distribution). It is strange that it is not enable by your ditribution. Do you have multiple firewalls on this machine ?

share|improve this answer
It does start iptables at boot. The problem is that when I point another machine to it via a static route like: [] --> [] --OpenVPN-- [] --> [] : After a reboot it fails to NAT. When I restart iptables it starts NATing again. I think it is because is the IP of the tun0 interface, which doesn't exist until OpenVPN starts. – btk_ Nov 26 '10 at 17:17
iptables starts even if the interface is not up. To check, reboot, restart iptables, and then restart OpenVPN. Nat should be OK. I think there is a problem in the loading of iptables modules. – Dom Nov 26 '10 at 17:29
I'm not sure that iptables will run if the interface is no there and you are using SNAT/DNAT. Tray to use MASQ - in this case for sure the rule will be loaded even interface is not present at that time. – ntk Nov 26 '10 at 17:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.