Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a question regarding OpenVPN and Linux NATing.

OpenVPN server ( <--> ( OpenVPN client ( <--> ( Internal LAN

I have set up a basic iptables rule on the client that says /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE. With this, I can ping from the server to the internal LAN. However, when I look at the tcpdump on the server side, I see the internal LAN IP. I need to see the IP of the OpenVPN server for classification reasons so I know where it went. Is there a way I can do another NAT on the return traffic so when the server sees the ping response, it comes from the IP instead of the 192.168.0.X IP?

Thanks for your help.

Edit - I thought I would be able to do something like this but it doesn't seem to be working.

/sbin/iptables -t nat -A POSTROUTING -o tun0 -j SNAT --to-source
share|improve this question
Your diagram says "the server" IP is yet the question states, "I need to see the IP of the OpenVPN server." Which is it? Instead of using the terms client/server how about host-a,host-b or some other less confusing system. – dfc Oct 18 '11 at 21:52
If you look at my diagram you see the server to client to internal LAN. (LanA <-> ServerA <-> ClientA <-> LanB) I am going to have multiple client's connecting to ServerA and I want to be able to distinguish which Client is sending me traffic by seeing the Client's tun0 address. Which in this case is I know I can use different tun interfaces for each but I don't feel like dealing with 10+ tun interfaces. I'd rather be able to say if traffic is coming from it is ClientA. Maybe is ClientB, and so on. – user22492 Oct 19 '11 at 13:27

Please specify what address you are pinging and from which host.

I assume that you ping (or any other host in different than from and you want the response to come from And that is incorrect. IP protcol does not work this way. :-)

share|improve this answer
Initial request = --> --> --> forward and NAT to Response = --> --> --> (this address sees as the source) I want to be able to NAT on the return traffic just like I did on the initial. If this is not possible, then I need another way to be able to distinguish ClientA's subnet from ClientB's subnet if they both use the same IP scheme. – user22492 Oct 21 '11 at 19:30
Try using DNAT and SNAT instead of MASQUERADE. Maybe it will help... Maybe. :-) – 0xFF Oct 24 '11 at 12:40

If you didn't configure static IP for tun0 on the client, you must use MASQUERADE:

iptables -t nat -A POSTROUTING -s -o tun0 -j MASQUERADE

otherwise, you can use SNAT:

iptables -t nat -A POSTROUTING -s -o tun0 -j SNAT --to-source
share|improve this answer
I've tried that solution and it doesn't appear to be working. I still see the response packet from the subnet. – user22492 Oct 11 '11 at 15:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.