Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a program which writes packets (destination address to the TUN/TAP interface.



Wireshark captures these packets from interface tun0 but they are not forwarded to interface eth1.


sysctl -w net.ipv4.ip_forward=1
sysctl -p

iptables -A INPUT -i tun+ -j ACCEPT

iptables -A FORWARD -i tun+ -j ACCEPT

iptables -A INPUT -i tap+ -j ACCEPT

iptables -A FORWARD -i tap+ -j ACCEPT

/etc/init.d/networking restart

/etc/init.d/openvpn restart
share|improve this question
I hope you get a better response than me, I asked a very similar question regarding KVM guest virtual machines! Still a ghost town over there. Haha. – ajstein Jun 7 '11 at 18:48
Are you trying this in a full blown Linux install or are you doing this in a VPS? I'm curious because this seems to pop up frequently with OpenVZ VPS boxes and OpenVPN. – Taco Bob Jan 27 '13 at 3:02

Are you using a tun or a tap ?

If you want your remote hosts to be in the same subnet, you should use tap instead of tun, remove from eth1, create a bridge between eth1 and tap0, and assign to the bridge interface.

This is slightly less efficient than a tun, but will allow non-IP and broadcast traffic between your vpn hosts and the local network. (and consequently, allow your vpn hosts to use a dhcp server on the local net, or spoof their addresses if they want to).

If you want a separate network for your vpn hosts, you should dedicate a pair of addresses for the tunnel (or more if you are using openvpn in multi-client server mode instead of in p2p mode), and you should make sure these addresses are bound to the tun interface, and that the tun is up. In your drawing there is no address for the tunnel.

Depending on your distribution, restarting the networking service may be destroying the changes you made to iptables.

share|improve this answer

You need to setup bridging between your two interfaces (tun0 and eth0), here is some documentation about how to setup bridges:

share|improve this answer
That would be for a tap interface, not a tun interface. – b0fh Feb 10 '12 at 11:49

the problem you are having is due to not having enabled the gre module in kernel: sudo modprobe ip_gre

share|improve this answer
What would make you think that? – kasperd Mar 10 at 13:54

protected by HopelessN00b Mar 10 at 13:12

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.