Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got OpenVPN configured to route all IPv4 traffic from client through the server, NAT'd to the internet (openvpn/server.conf contains the following):

push "redirect-gateway def1"

I'm NAT'ing the traffic to the web using an iptables rule:

iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

Traffic to and from the web works fine (HTTP, HTTPS). However, I can't get my mail client ( on OS X, in this case) to connect to a mail server. I can verify that the mail server is both running and that my settings are correct by running an SSH-tunnel from localhost->server, then pointing the outgoing SMTP server to the localhost:port (this works). However, this is a little ... clunky, and I'd like to know why I can't run it over the VPN - the only issue seems to be the localhost->server connection.

Incoming POP account works fine. I'm not really sure where I should look, or how to solve for the outbound SMTP, though - any ideas are appreciated.

share|improve this question
Can you clarify your setup? The OpenVPN server is also the mail server? – cjc Feb 16 '12 at 21:13
Yes - the server is running the OpenVPN server, and the SMTP server. Mail is at, OpenVPN server is at, both A records pointing to the same public IP. – simont Feb 16 '12 at 21:29
Is the SMTP server binding to all interfaces? What port are you trying to connect to it on (25, 465, 587)? – cjc Feb 16 '12 at 21:44
up vote 0 down vote accepted

Here's what I think is happening:

When you set push "redirect-gateway def1", you change the default route the Mac to go over the VPN, but there's a host-specific route that is retained so that the client can find the OpenVPN server. This host-based route will go over the ISP's gateway, etc. If you don't have this host-specific route, your VPN connection will break because the your Mac will no longer be able to route to the OpenVPN server.

So, when you specify the mail server on the Mac's client, you're not going over the VPN, but over the Internet. If your ISP is blocking SMTP (tcp/25), then you're going to fail to connection. I just want to confirm that your Mac is set up this way for mail.

There are a couple ways to handle this:

1) Not care about routing mail over the VPN. The ISP should be allowing SMTP submission (port 587) or SMTPS (port 465). You can configure your mail server to require SSL, and your traffic should be safe.

2) If you want all your mail to go over the VPN, and the VPN will be up all the time, then bind the SMTP process to all interfaces, including the OpenVPN one. Then change the Mac mail client configuration to point at

share|improve this answer
The ISP I'm currently using does not appear to allow SMTP submission. My SMTP process was bound to all available interfaces, but I hadn't restarted the service since I implemented OpenVPN. Thanks for the help, (2) works wonderfully. – simont Feb 16 '12 at 22:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.