Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a situation I can't really handle on my own. I've got an openvpn server and a client, which actually is a debian based router. To my debian based router I've connected a pc with a static ip address. I want to be able to connect from the OpenVPN server to the pc on port 60.

[server:] -> [client (tun0):] -> [client (eth0_lan):] -> [pc:]

On the client, there are no iptables rules set. So I've started with:

iptables -t nat -A PREROUTING -p tcp -d --destination-port 60 -j DNAT --to

Using tcpdump I can see the packets flowing

# tcpdump -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
12:14:38.456427 IP > Flags [S], seq 3745909032, win 5840, options [mss 1368,sackOK,TS val 3685104628 ecr 0,nop,wscale 7], length 0

# tcpdump -i eth0_lan
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0_lan, link-type EN10MB (Ethernet), capture size 65535 bytes
12:15:36.928081 IP > Flags [S], seq 378990321, win 5840, options [mss 1368,sackOK,TS val 3685163144 ecr 0,nop,wscale 7], length 0
12:15:36.928835 IP > Flags [S.], seq 1252114870, ack 378990322, win 1448, options [mss 1460,sackOK,TS val 4593688 ecr 3685163144,nop,wscale 0], length 0

So packets are coming from my server and are forwarded to the pc. Unfortunately when pc responds, they only get to eth0_lan and are not getting to the tun0 interface.

I've tried adding:

iptables -A FORWARD -i eth0_lan -o tun0 -m state --state ESTABLISHED,RELATED -j ACCEPT

but it didn't help.

What iptables rule am I missing in here to make it work?

EDIT: This might or might not help:

# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface        *        U     0      0        0 tun0     *        U     0      0        0 eth1     *        U     0      0        0 wlan0        *        U     0      0        0 eth0_lan
default         debwrt.lan         UG    0      0        0 wlan0
default         debwrt.lan         UG    0      0        0 eth1

Executed on the client, where debwrt.lan is: [router on my network].

share|improve this question
Just trying to clarify, here: You're logged in to and you want to connect I don't think you need any NAT rules, here, just a route through the VPN and a FORWARD rule on the Debian box to allow the traffic through at that end. –  SmallClanger Feb 23 '11 at 14:24
On I want to connect to and have all the packets forwarded to Packet forwarding seems to work fine with the rule I've set, however they are not coming back to –  Krystian Feb 23 '11 at 16:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.