Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server with a public IP address. Let's call it $EXTERNAL. On that server, I have an OpenVpn server.

The server is set up to run a network:


I have a router running tomato firmware that has a OpenVpn client connected. The router has a lan of Here is the router's routing table:

# netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface UH       40 0          0 tun11   U        40 0          0 vlan1   U        40 0          0 br0   UG       40 0          0 tun11       U        40 0          0 lo         UG       40 0          0 vlan1

I can ping from the router. I can ssh into my external server both as

me@tomato>$ ssh 


me@tomato>$ ssh $EXTERNAL

However, from a computer on the 10.1.1.x network, I cannot reach the vpn server by it's vpn ip.

me@>$ ssh

fails, but

me@>$ ssh $EXTERNAL 


Also, I don't know if this is related, but from the router,

me@tomato>$ telnet 80

fails, but

me@tomato>$ telnet $EXTERNAL 80


share|improve this question
up vote 1 down vote accepted

You need to add a route to on the VPN server for the clients to be able to reach it:

root@vpn-server:~# ip route add via
share|improve this answer
You would also need to enable some address translation on the vpn server to allow the lan clients to access to internet. – petrus Apr 22 '12 at 14:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.