Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
  • I'm able to connect successfully from a laptop to my server using Openvpn.
  • I have ipv4 forwarding and NAT enabled on the server.
  • I can access the web, etc.

But the server also has a S2S VPN with Racoon enabled. When I SSH to my server and then 'telnet 80' to the racoon-connected-server it works perfect.

But when I connect from the laptop (which comes over Openvpn) to one of the IPs in the Racoon S2S VPN subnet, it fails.

Any ideas how to setup Racoon together with Openvpn?

share|improve this question

You have to configure openvpn to push the IPSEC routes to openvpn clients. in your "server.conf" file add on line like this for each network you want to make accessible:

push "route w.x.y.z"

disclaimer: the w.x.y.z and the network mask must be adapted to your configuration.

Also note that this way the packets from your laptop will go to the servers on the IPSEC subnets. Now you need to have the packets back to your laptop. The easiest, dirty way is to do a NAT on your racoon server.

edit: how to do the nat The masquerade rule you suggest might work, but I would recommand something more precise like:

iptable -t nat -A POSTROUTING --src <the openvpn client network> --dst <the ipsec networks not aware of the ovpn client network> -j SNAT --to-source <ip address of the openvpn server on network known to the ipsec network>
share|improve this answer
Thanks. But how do i do the dirty NAT? something like this: sudo iptables -t nat -A POSTROUTING -s w.x.y.z/24 -o eth0 -j MASQUERADE – Jonas Schnelli Apr 3 '12 at 7:03
MASQUERADE is deprecated for static IPs. You should use the method suggested by @olivier-s at the end of his answer. – Magellan Apr 3 '12 at 19:15

I suspect that the site on the other side of the S2S vpn doesn't have routing information for your OpenVPN subnet.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.