Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

The following problem is just a piece of the bigger solution I have a problem with. All other elements seem working so far, so I'll try to describe very small piece which I have problem with.

I've got a linux machine, with tun0 (tunneling interface) and eth0 (witch is my default gateway to the internet).

Goal: my goal is to receive packets incoming from tun0, and forward them to the default gateway. So actually quite simple NAT case, where I want to "share" internet with tun0 which fakes physical interface.

Tun has been created using

sudo openvpn --mktun --dev tun0 --user USER
sudo ip addr add dev tun0
sudo ip link set tun0 up

So I have it up and running, I can ping it etc. Furthermore, I have C++ application, which attaches to this TUN device, can read from and write to it. (fti: here is a tutorial I've followed: http://backreference.org/2010/03/26/tuntap-interface-tutorial/)

I dumped some correct ICMP (ping) request made to into the byte array in C++. Now, using my program I write it to the tun0 device. ICMP request has

  • source ( - so kernel knows the route back (the same subnet)
  • destination ( - Google's DNS
  • correct checksum etc. (in Wireshark /TShark it appears correctly on tun0)

Then, I have following routes:

iptables -F # flush
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
iptables --append FORWARD --in-interface tun0 -j ACCEPT

And here I'm stuck :( Packet does not get forwarded to the default gw (tshark sees it only on tun0 as received which i guess it's correct)

What's missing? Maybe some alternative approach (but it has to be done using tun device, and I have to be able to r/w to it). Additional info:

  • forwarding is enabled (/proc/sys/net/ipv4/ip_forward)
  • is reachable through eth0 (from local)
  • default gateway is correct (from ISP via eth0)
  • i've tried switching off rp_tables(echo 0 > /proc/sys/net/ipv4/conf/eth5/rp_filter)
  • and many others...

Thanks in advance for any hints!

share|improve this question
I know this is over a year old, but did you get anywhere with this? I have exactly the same problem. –  hplbsh Oct 29 '13 at 19:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.