Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My setup is like this: - server lan - vpn subnet - vpn server - apache server

openvpn server config

port port_number
proto tcp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/vpnserver.crt
key /etc/openvpn/keys/vpnserver.key
dh /etc/openvpn/keys/dh.pem
tls-auth /etc/openvpn/keys/ta.key 0
push "route"
ifconfig-pool-persist ipp.txt
keepalive 10 120
cipher AES-128-CBC
user nobody
group nogroup
status openvpn-status.log
log-append /var/log/openvpn.log
verb 3
mute 20
key-method 2
max-clients 15
plugin /usr/lib/openvpn/ "/etc/openvpn/auth/auth-ldap.conf"

openvpn client config

remote [public_ip_of_192.168.1.11] port_number
resolv-retry infinite
proto tcp
dev tun
ca filename.crt
tls-auth filename.key 1
cipher AES-128-CBC
ns-cert-type server
route-method exe
route-delay 2

I connect to the vpn from a remote location perfectly; subnet is reachable.
But, when I access apache server on, the apache log says that the request is coming from my public IP (the client's public IP).

Is it possible that apache sees the vpn IPs (192.168.3) and not each client's public one ?

Any help is appreciated !

share|improve this question
By 'public IP of' are you saying the machine is multi-homed, or are you connecting through a firewall with a port forward? – JustinP Jan 17 '12 at 11:30
Windows or Linux? If Windows, the OpenVPN client needs admin privs to be able to set the routes over the VPN interface. – cjc Jan 17 '12 at 11:59
@cjc I already said "subnet is reachable." – Stefanos Kalantzis Jan 17 '12 at 12:27
@JustinP VPN is behind firewall and is being port forwarded. – Stefanos Kalantzis Jan 17 '12 at 12:28

OK, then in my limited experience this should be working and I cannot see how you would have the external IP address appearing in the web server logs. It might be worth making absolutely sure that your TEST is working correctly. Is there any possibility that your webserver is also available via port forward through the firewall, and that you're accidentally accessing it directly - make sure you've explicitly put IP into the browser URL for instance.

Assuming that looks OK I have found using tcpdump on the openvpn server to be a good way to watch the packets go in and out, this would confirm whether packets are leaving the openvpn server bound for the apache server with the incorrect IP address rather than somehow going there direct from the firewall.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.