Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would need help in this case:

I have a tap0 interface at my openvpn server with ip

My eth0 interface is

Route tables: - - - eth0 - - - tap0 - - - eth0

With the following rules I can ping from my lan to the vpn clients:

iptables -v -t nat -A PREROUTING -i eth0 -d -j NETMAP --to

iptables -t nat -A POSTROUTING -o tap0 -j MASQUERADE

I have a route in the lan client to my vpn server. Tcpdump shows that packets redirect from eth0 to tap0 and the netmap works.

But when I try the opposite I can not ping from the vpn clients to my lan

iptables -v -t nat -A PREROUTING -i tap0 -d -j NETMAP --to

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

The tcpdump shows that packets reach tap0 but does not go to the eth0. It is like the netmap rule would not work.

Could you help me? What am I doing wrong?

share|improve this question

you're doing it wrong.

1st - use layer 3 connections instead of layer 2 for vpn. Saves traffic.

2nd - use brouting to get the trick done with proxy-arp and assing ip addresses from the local subnet to the vpn clients - so they just appear as they're local

3rd - or use routing and set the route to the clients in the 10.22.8/24 subnet on all systems in the OR just use the vpn system as the default gateway to avoid routing problems...

Using brouting:

  • Enable proxy_arp on the linux router: echo 1 > /proc/sys/net/ipv4/conf/proxy_arp
  • Add the route of the subnet to eth0 if not happened automagically
  • Add the route of a subnet of the local subnet to the tun device from openvpn.

    Lets say we're going to use the last 16 IP-addresses for the hosts on the vpn ( - that means we have a 28 bits subnet Create the tun device static (openvpn --mktun) and then add the route for the vpn subnet to the device ip route add dev tun0

After this, and after enabling ip forwarding and proxy arp the linux system will "broute" all requests from the local clients to the clients at the vpn end and vice versa.

And you have an layer 3 vpn (faster, less traffic) with layer 2 connectivity and fully transparent access to all systems.

Filtering and everything else can be done via iptables.



share|improve this answer
Hello. Thank you for your reply. The problem is that I have the same subnet at both sides. At my lan where the openvpn server is, and at the Lan from the vpn clients connect. – vitidandu Dec 2 '10 at 8:43
I can not put the vpn net in my server as default gw because in that case I could not reach internet an I could not connect from my clients. – vitidandu Dec 2 '10 at 8:50

Hello and thank you very much for your help. Finally I decided to follow the third point.

The clients in my corporate lan are configured with a double ip.

The normal 192.168.1.X and the vpn one 10.22.8.X

The vpn clients have double ip in both nets:


inet brd scope global eth1

inet scope global eth1

Routing table - - - UG - eth1 - * - - U - eth1

The server has proxy_arp, arp_accept and ip_forward available. It is working ok by the moment.

I greatly appreciate your help Gromit.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.