Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For some hours I'm already trying to setup a virtual private network between two physical locations (Location A,, and (Location B, I am forced to use a tunnel instead of bridged networking. is the VPN network. The connection between the two locations works fine, server has and the client But now I want the server to access a server on the client-side network, which address is

How do I achive this with routes and iptable entries (presumably NAT postrouting?)?

share|improve this question

Try this.

On the server:

route add -net gw

On the client:

iptables -t nat -I POSTROUTING -s -t -j SNAT --to

That alone should probably work. Read on if you want to consider other options though.

You should be able to do without the iptables rule if the client happens to be the default gateway for the network of if you add this route in either the destination server or its default gateway:

route add -net gw <IP_of_client_on_this_network>

You can also replace net with just (etc.) if you want only that server to be reachable - but if you mean to be filtering you should probably add a separate filter rule on the server and/or client.

If you are already filtering on the client (I mean if you have FORWARD rules, see iptables -nvL) you have to add another rule there:

iptables -I FORWARD -i tun+ -s -d -j ACCEPT

Edit: deleted -i from the POSTROUTING rule, that was a mistake.

share|improve this answer
Thanks for your reply. The route should do the job, but it doesnt seem to work properly. I have tshark running on both machines to monitor ping requests to the target machine. I've added the route as you've posted above, which results into outgoing packets on the server side (without the route, they are not sent of course), but on the client side, it does not monitor any packets on the tun0 device. – anonvpn May 2 '11 at 12:45
Can you ping from the server? Do you see the ICMP packets on the tun0 device on the client then? – Eduardo Ivanec May 2 '11 at 13:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.