Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a openvpn subnet running one server and one client (laptop). openvpn works fine. Browsing the web over openvpn from the laptop works also fine.

Now on the server there is a private subnet with The subnet is set up with racoon (IPSEC s2s vpn). The s2s vpn allows me to access the subnet at the other s2s vpn end. Works all fine when I'm connected with ssh to my server.

From my laptop i can ping (the servers ipsec local ip) but i cannot reach the net

I tried to add a static route on my laptop over gw with no success.

Any ideas how i do setup the nat / routing?


share|improve this question

1 Answer 1

up vote 1 down vote accepted

Most likely, the network doesn't know who you are and how to get to you.

You need to add the route for with gateway to the router for the network. You may also need to add an IPSEC rule to encrypt traffic destined for

Additional routes may also be required, depending on your network topology.

share|improve this answer
Is there no way without changing Nat or something? I would like that the laptop operates as it would be the server. There are also free ip's on (.130, .131, etc.). Anyhow possible? – Jonas Schnelli Apr 3 '12 at 11:06
Yes, you can configure your OpenVPN server to NAT traffic from so that it looks like it's coming from its own IP address. That would obviate the need for routes. Something like /sbin/iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source assuming eth0 is the interface for – cjc Apr 3 '12 at 11:16
You're not trying to bypass your network administrators, are you? – cjc Apr 3 '12 at 11:20
No. I just try to access a IP behind S2S VPN over remote laptop vpn. – Jonas Schnelli Apr 3 '12 at 12:21
Hmm.. the iptable rule works. But now all my traffic goes to So browsing the web is no longer possible. How can i tell iptables to just NAT traffic to (THANKS by the way!) – Jonas Schnelli Apr 3 '12 at 12:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.