Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My first time trying to set up OpenVPN. I followed the HOWTO guide from OpenVPN's site and was successfully connected but when I tried to route my web traffic, it seems that nothing gets through to my server.

My server is an Amazon EC2 box and my client is MacOS Lion. I'm using Tunnelblick on the Mac. I have run/tried the following:

  • ran iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE on my server
  • disabled firewall on the mac
  • enabled UDP 1194 on EC2 firewall
  • tried both dev tun and dev tap
  • tried using Amazon's name server with "push "dhcp-option DNS" as well as Google's[/list]

Here is my server config file:

server ifconfig while running OpenVPN:

server log, with one client connecting and trying to open a webpage after successful connection:

Client config file:

client ifconfig while running OpenVPN:

client log:

The only error I notice is in the client log, where it says:

2012-05-06 20:43:44 us=732786 /sbin/ifconfig tap0 delete
                                    ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2012-05-06 20:43:44 us=738214 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure

Could that be the problem? I found some webpage that said Tunnelblick used to have problems with Lion, but the version I'm using is higher than the one mentioned as the fix.

In addition, I noticed that after running iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE (with su), my server still shows just the following if I do netstat -rn

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface   U         0 0          0 eth0         UG        0 0          0 eth0

The server doesn't seem to have gotten the new routes. Is this the problem?

Please help. Thanks!

share|improve this question

migrated from Jun 21 '12 at 13:59

This question came from our site for professional and enthusiast programmers.

Have you enabled ip_forward on server?

cat /proc/sys/net/ipv4/ip_forward # 0 disabled, 1 enabled

enable it to allow masquerading:

echo 1 > /proc/sys/net/ipv4/ip_forward

and to make change permanent, edit /etc/sysctl.conf:

# Uncomment the next line to enable packet forwarding for IPv4
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.