Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've set up an openvpn server alongside an apache website that can only be accessed on port 8100 on the same machine. My /etc/openvpn/server.conf file looks like this:

port 1194
proto tcp
dev tun
ca ./easy-rsa2/keys/ca.crt
cert ./easy-rsa2/keys/server.crt
key ./easy-rsa2/keys/server.key  # This file should be kept secret
dh ./easy-rsa2/keys/dh1024.pem # Diffie-Hellman parameter
ifconfig-pool-persist ipp.txt
# make sure clients can still connect to the internet
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
status openvpn-status.log
verb 3

Now I tried to let only clients connected to the vpn network access the website on apache via port 8100. So I defined a few iptables rules:

# My system IP/set ip address of server
# Flushing all rules
iptables -F
iptables -X
# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# Allow incoming access to port 8100 from OpenVPN
iptables -A INPUT -i tun0 -p tcp --dport 8100 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o tun0 -p tcp --sport 8100 -m state --state ESTABLISHED -j ACCEPT
# outgoing http
iptables -A OUTPUT -o tun0 -p tcp --dport 8100 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i tun0 -p tcp --sport 8100 -m state --state ESTABLISHED -j ACCEPT

Now when I connect to the server from my client computer and try to access the website on, my browser can't open it. Will I have to forward traffic from tun0 to eth0? Or is there anything else I'm missing?

FYI: I'm running ubuntu server 12.04.1 LTS. Iptables is installed.

share|improve this question

Since you are using subnet/IP different than the one provided by OpenVPN, you probably need to allow the server to do NATting for this to work.

Run the following commands:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

You should fine tune the iptables rule to fit your need. This should get you working.

share|improve this answer
Thanks for the advice. I tried that one but didn't help. But I think, I just gave a bad example since I used the server id first. In this case, it's actually for the server and for the openvpn server. – Andy M Nov 24 '12 at 19:36 would't connect to without some form of routing. Check you subnet configuration in your server.conf. – melsayed Nov 24 '12 at 19:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.