Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was following this tutorial and this one to create openvpn connection to my remote LAN.

But both examples assumed that both LANs have different addresses (ie and, check out this image

Unfortunately in my case both local and remote lan have addresses. I am able to connect directly on the openvpn server (I can ping it and log in with ssh), but I can't see other devices on the remote LAN (not mentioning accessing them via browser which was the point from the first place). And don't know if the addressing issue may be the reason of that? If not - how to define routes, so I could ping other devices in remote LAN?

share|improve this question
I should maybe mention that openvpn server is behind publicly available router, which has forwarded port 22 to local and the same way 1194 port for openvpn – meta Oct 11 '12 at 23:13
up vote 2 down vote accepted

You're sunk. All the machines are using the same subnet. How do you propose they would be able to distinguish local from remote hosts? Your only option here would perhaps be some form or port forwarding from the VPN hosts at each site. This would work for a few services, but would be a nightmare to support long term.

You really just need to bite the bullet and re-number one of the sites.

My guess is that you don't have a good grasp on some core networking fundamentals. I'd highly recommend you read though this Serverfault Q&A on IPv4 subnetting. That will help you better understand the why behind your present difficulties.

share|improve this answer
Thank You Eric for confirming my guess. And yes, your guess is correct as well, I have some stuff to get my head around regarding networking. I will definitely read what you suggest. – meta Oct 12 '12 at 5:41
ps. I just got the idea. My local network is somehow defined by router I'm "behind" - I would not always have power to re number it. Is there a way to hide myself behind some kind of "virtual router" so I'm in the "local-local" network I can control? I work on ubuntu linux so I guess this should be possible but what should I google? – meta Oct 12 '12 at 6:04
Sorry, with your current state of networking knowledge, you have no business trying to do anything complex or unorthodox. Get your head around the basics and then the solution (which is re-numbering) will become self evident. – EEAA Oct 12 '12 at 14:47
Oh, come on. You don't need to be overprotective. Let's say I can not re-number any of those networks. Just give me a hint what to look for and I will bang my head through this wall. I promise I will not hurt myself in case of failing ;) – meta Oct 12 '12 at 18:50
I'm not being overprotective. I'm being realistic. What you propose is impossible. Read about how routing works. – EEAA Oct 12 '12 at 20:57

Even if this question is already answered, here is another option:

  • Assign a secondary IP in a free subnet to the gateway on one side
  • Use the NETMAP target in iptables to translate everything

If you choose as alternative subnet on one side, you could use this rule to translate the Network:

iptables -t nat -A POSTROUTING -o tap0 -j NETMAP --to
share|improve this answer

In my opinion, NETMAP is actually a pretty valid way of making sure that networks won't collide. Many routers use the same private address space and sometimes there's just no way of changing a setup for a network you don't own (e.g. in an internet café, public WLAN). Yes, you could change your own network to use a rather uncommon address space, but some providers distribute locked-down equipment with no way of changing that, which would require you to add more network gear. Oh, and sometimes it's just very convenient to type 10.0.0.x instead of e.g. 192.168.214.x.

TL;DR: While not advisable in professional setups, NETMAP might come in handy.

Here's an example that allows me to use 10.0.0.x on both sides and still connect via OpenVPN. Instead of pushing the real route to clients, you use an uncommon subnet:


push "route"


iptables -t nat -A PREROUTING -d -j NETMAP --to

Source NAT (assuming you're using OpenVPN's default subnet)

iptables -t nat -A POSTROUTING -s -o eth1 -j SNAT --to-source PUBLICIP

This works pretty well, even with default gateway replacement. It might get messy if you're using your own DNS:

push "dhcp-option DNS"

That's because though you'll be able to reach the DNS server (which is on, it returns addresses based on it's subnet, not the NETMAPed one. There might be ways around that. I'm thinking of BIND's views, e.g., no idea whether Samba is capable of something like that.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.