Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to have access to my office LAN from my private server

I have successfully set up a VPN tunnel between my private server and my computer at my office using this link.

I can for instance ping both my server from my computer and my computer from my server. I use then 10.9.8.[1-2] IPs (1 for the client, 2 for the server).

Now, my office lan is in a 172.24.x.x/16 network.

I have create a route on my server side (route add -net gw (the IP of my computer at work) dev tun0 And enable the ip_forwarding on my computer at work.

However, nothing is routing when from my server I ping a random IP on my work-LAN.

Nothing in syslog and the packet is not received by my computer.

Does anyone have any clue to help me with this issue?

Many thanks for helping

share|improve this question
Need moar info. Perhaps OpenVPN configs, and addressing for your network. As with most routing problems your answer can usually be find by correct using of tcpdump + traceroute. – Zoredache Jan 25 '12 at 18:50
up vote 2 down vote accepted

Aside from enabling IP forwarding and setting the route to on your client computer (which is done with the push route directive in your OpenVPN server's config), the hosts in your office LAN need to know the route back to the VPN network If you can't or don't want to change the back routes, you might resort to NAT at the OpenVPN server:

 iptables -t nat -A POSTROUTING -i tun0 -o eth0 -j MASQUERADE

This would allow connections from your OpenVPN client to your office LAN, but not vice versa.

share|improve this answer
Thanks. The rule iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE solved my issue :) – philippe Jan 26 '12 at 21:55

To access your work-LAN from your VPN client, you'll need:

  1. net.ipv4.ip_forward=1 in the VPN endpoint's sysctls.
  2. The VPN endpoint should be the default gateway for the work-LAN
  3. push "route" must be in the server config for your VPN client to access that network from home

If the VPN endpoint is not the work-LAN router, it's possible to do it but it's a bit different.

share|improve this answer
Thanks a lot for your answer. 1 and 3 are set up, but the VPN endpoint is not the default gateway. I have thought that the packets would go between the tun0 and the eth0 interface (thanks to net.ipv4.ip_forward=1), but obviously this is not the case. Could you please tell me more about how to set it up, without having the VPN endpoint as the work-LAN Router? Thanks again – philippe Jan 25 '12 at 20:06
In that case, the packets will get routed correctly from your client to the destination computer. For example, a ping will get there from your VPN client. But the reply will be sent to the default gateway and then it gets lost. Are you responsible for the default gateway? – Luis Bruno Jan 25 '12 at 21:33
I am not responsible for the default gateway hence I can not change it :/ However, I have set up the iptables iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE and get it working :) Thanks for your answer – philippe Jan 26 '12 at 21:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.