Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i try to setup openvpn on a vps and I'm able to establish a connection to the server, but the gateway isn't assigned to the client.

Here are my config files:

client config:

dev tun
proto udp
remote 1194
resolv-retry infinite
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
verb 3

server config:

port 1194
proto udp
dev tun
ca easy-rsa/2.0/keys/ca.crt
cert easy-rsa/2.0/keys/server.crt
key easy-rsa/2.0/keys/server.key
dh easy-rsa/2.0/keys/dh2048.pem
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS"
push "dhcp-option DNS"
keepalive 10 120
user nobody
group nobody
status openvpn-status.log
log openvpn.log
log-append openvpn.log
verb 3

ifconfig client:

inet --> netmask 0xffffffff
open (pid 42823)

iptables rules on the server:

iptables -L

Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
ACCEPT udp -- anywhere anywhere state NEW udp dpt:openvpn
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target prot opt source destination 

I want to route the whole traffic over the VPN. I already added redirect-gateway, so it should work. I really can't see whats wrong here and I hope that you can help me to fix the issue.


share|improve this question

After connecting to the VPN, run the command route -n or netstat -rn on the client and see if the gateway address is assigned.

Check if you've done the following:

On the server:

push gateway to client:

Add this to file: /etc/openvpn/server.conf

push "redirect-gateway def1"

Add this to file: /etc/sysctl.conf


Or issue the following command to set this variable for the current session:

echo 1 > /proc/sys/net/ipv4/ip_forward

Issue the following commands to configure iptables to properly forward traffic through the VPN:

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s [vpn client subnet] -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s [vpn client subnet] -o eth0 -j MASQUERADE


share|improve this answer

Try removing:


in the client configuration.

You are already pushing the redirect-gateway configuration via the push mechanism of the server and only in that case you are sending it with the correct parameter (def1).

The behavior of redirect-gateway without parameter is openvpn-version-dependent (and you did not specify your specific version) so better be on the safe side.

If this does not help, I see different possible problems.

I suggest the following troubleshoot:

  • check that you can ping the other side of the tunnel
  • if yes, try adding manually the default gateway pointing to the remote side of the tunnel and try pinging (to remove a possible problem in the DNS you are pushing through the tunnel)
  • if that does not work, your problem is likely in the nat configuration (you did not post the result of iptables -L -t nat) or in the forwarding configuration
  • if that works, but pinging does not work your problem is likely in the DNS configuration
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.