0

For context, I am migrating my VPN server. I duplicated the old set up almost exactly, and now clients connected to the new VPN server cannot tunnel properly (but they connect just fine).

While tunneled, this is the routing table of my client:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.8.0.5        0.0.0.0         255.255.255.255 UH        0 0          0 tun0
10.8.0.1        10.8.0.5        255.255.255.255 UGH       0 0          0 tun0
[vpnserver-ip]  10.105.0.1      255.255.255.255 UGH       0 0          0 wlan1
10.105.0.0      0.0.0.0         255.255.252.0   U         0 0          0 wlan1
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 wlan1
0.0.0.0         10.8.0.5        128.0.0.0       UG        0 0          0 tun0
128.0.0.0       10.8.0.5        128.0.0.0       UG        0 0          0 tun0
0.0.0.0         10.105.0.1      0.0.0.0         UG        0 0          0 wlan1

At the same time, here is the routing table of the server

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         [vpn-gate].1    0.0.0.0         UG        0 0          0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG        0 0          0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH        0 0          0 tun0
[vpn-sub].0     0.0.0.0         255.255.255.0   U         0 0          0 eth0

The table of the new VPN server is basically identical to that of the old one, so I'm not sure what is missing? Why won't this tunnel properly?

I've redacted the IP of the VPN server.

1
  • Can you ping from client to vpn server? Vice versa? If you run tcpdump, what do you see?
    – jamieb
    Jul 19, 2012 at 19:43

1 Answer 1

2

You probably haven't configured IP masquerading on the server for outgoing packets from VPN clients. You can check this configuration on the old server with iptables -nvL -t nat. You need something like the following on the new server:

iptables --table nat --append POSTROUTING --out-interface eth0 --source 10.8.0.0/24 --jump MASQUERADE
1
  • Also, just as an FYI (since I was having the same problem as the OP and this answer solved it), you will need ipv4 tunneling turned on in /etc/sysctl.conf and iptables must be running
    – CamelBlues
    Feb 5, 2013 at 15:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .