Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

First off: I have looked all over for a solution to this, but couldn't find anything.

How can I make OpenVPN's subnet accessible to my LAN?


I have an openSUSE 12.1 box that is my NAT router. The internet is on eth0 and my LAN ( is on eth1. OpenVPN creates the tun0 device, which I also added manually to the network interfaces list in YaST, so to be able to assign it to the firewall's internal zone. OpenVPN's subnet is

I have checked "Enable IP Forwarding" in YaST's "Network Settings" and I am using "Masquerade Networks in YaST's SuSEFirewall settings. In /etc/sysconfig/SuSEfirewall2 I have set FW_MASQ_NETS="" The "Network Settings"' routing table is currently empty.

At this point I can reach and the rest of the world from my VPN's, since OpenVPN's server.conf sais push "redirect-gateway def1 bypass-dhcp".


What I want now is to be able to reach VPN-connected machines ( from my LAN ( How do I do this the right way in openSuSE?

share|improve this question
up vote 0 down vote accepted

If i understood correctly, you should already be able to do that (unless you have some firewall rules in place that disallow this).

Since your vpn server acts as a default gateway for both your networks (vpn+internal), and it knows the all the correct routes, it should work without any additional settings. Both networks are "locally connected" (OpenVPN acts as a local interface too, so it's route is immediately added), so no need for additional routes.

share|improve this answer
That's exactly what I was thinking, but in practice it seems like packtes from a address never find their way to a address. The funny thing is though, that a ping from the VPN subnet to the LAN subnet does yield a return packet. – derabbink Aug 28 '12 at 12:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.