Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've an openVPN client which runs on windows2008 R2 server and through this windows 2008, I'm trying to do static nat to a machine which lies behind this win2008s real network. Here is my configuration for 2008 server;

  • OpenVPN server;
  • OpenVPN connection: "Local Area Connection 2"
  • Local network: "Local Area Connection"

output of my NAT configuration on 2008 server

    # ----------------------------------
    # NAT configuration
    # ----------------------------------
    pushd routing ip nat
    set global tcptimeoutmins=1440 udptimeoutmins=1 loglevel=ERROR
    #NAT Configuration For Interface Local Area Connection 2
    add interface name="Local Area Connection 2" mode=FULL
    add addressrange name="Local Area Connection 2" start= end= mask=
    add addressmapping name="Local Area Connection 2" public= private= inboundsessions=enable
    #NAT Configuration For Interface Local Area Connection
    add interface name="Local Area Connection" mode=PRIVATE

When I try to ping from openvpn server or connect to a tcp port on it, I see destination nat is done on windows 2008 server and my packets are sent to but with source ip

  19:54:25.046131 IP > Flags [S], seq 870055875, win 5840, options [mss 1350,sackOK,TS val 8948005 ecr 0,nop,wscale 7], length 0
19:54:25.046198 IP > Flags [R.], seq 0, ack 870055876, win 0, length 0
  19:54:28.044561 IP > Flags [S], seq 870055875, win 5840, options [mss 1350,sackOK,TS val 8951005 ecr 0,nop,wscale 7], length 0

and for sure, returning packets does not find their way to originator then.I also tried not to map hosts directly but service/port translation but this didn't work either. In my linux boxes, I can of course change the source IP address while doing nat with iptables but for very same scenario, I couldn't find how to do this on windows.

So, do you have any idea how to change source ip while doing NAT with windows servers?

thanks for the help in advance


share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.