Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For context, I am migrating my VPN server. I duplicated the old set up almost exactly, and now clients connected to the new VPN server cannot tunnel properly (but they connect just fine).

While tunneled, this is the routing table of my client:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.8.0.5        0.0.0.0         255.255.255.255 UH        0 0          0 tun0
10.8.0.1        10.8.0.5        255.255.255.255 UGH       0 0          0 tun0
[vpnserver-ip]  10.105.0.1      255.255.255.255 UGH       0 0          0 wlan1
10.105.0.0      0.0.0.0         255.255.252.0   U         0 0          0 wlan1
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 wlan1
0.0.0.0         10.8.0.5        128.0.0.0       UG        0 0          0 tun0
128.0.0.0       10.8.0.5        128.0.0.0       UG        0 0          0 tun0
0.0.0.0         10.105.0.1      0.0.0.0         UG        0 0          0 wlan1

At the same time, here is the routing table of the server

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         [vpn-gate].1    0.0.0.0         UG        0 0          0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG        0 0          0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH        0 0          0 tun0
[vpn-sub].0     0.0.0.0         255.255.255.0   U         0 0          0 eth0

The table of the new VPN server is basically identical to that of the old one, so I'm not sure what is missing? Why won't this tunnel properly?

I've redacted the IP of the VPN server.

share|improve this question
    
Can you ping from client to vpn server? Vice versa? If you run tcpdump, what do you see? –  jamieb Jul 19 '12 at 19:43

1 Answer 1

up vote 2 down vote accepted

You probably haven't configured IP masquerading on the server for outgoing packets from VPN clients. You can check this configuration on the old server with iptables -nvL -t nat. You need something like the following on the new server:

iptables --table nat --append POSTROUTING --out-interface eth0 --source 10.8.0.0/24 --jump MASQUERADE
share|improve this answer
    
Also, just as an FYI (since I was having the same problem as the OP and this answer solved it), you will need ipv4 tunneling turned on in /etc/sysctl.conf and iptables must be running –  CamelBlues Feb 5 '13 at 15:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.