Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've set up an L2TP/IPsec VPN using OpenSwan and xl2tpd using the "nodefaultroute" ppp option. The server's virtual IP address is set to and it allocates addresses in the range This sets up PPP links between <-> etc. and this works fine - the VPN-connected hosts can communicate with the server.

How can I set up the ppp link so the server end looks like the entire range instead of just that IP address? I am hoping that connecting clients will then route any requests for that subnet via the VPN interface, where the server can catch them and act as a gateway. Going in the other direction, the "proxyarp" option will allow the VPN server to catch traffic back to the VPN clients.

One obvious solution to this is to use the VPN server as the default route. I would prefer not to do this, so that only the traffic specific to that subnet goes through the VPN. Is this even possible?

share|improve this question
Networking terminology is complex, and context seems to be required for everything. Please don't take this personally, but even with a couple decades of TCP/IP networking, I simply cannot figure out what you are describing. There are too many poorly defined words involved here. The variety of tunneling and virtual things involved don't help. In lieu of a much longer post, maybe a diagram of what you have, and what you want, might help (be sure to label all interfaces, virtual or real). – Skaperen Dec 5 '12 at 6:53
@Skaperen Yep I'm slightly less dumb now. Thanks for the kindly-written comment. – Tom Apr 9 '13 at 12:57

As I suspected the problem is that I'm a bit of a numpty. In case anyone finds this question and is wondering the same thing, these are the key things you should know:

nodefaultroute doesn't go in your VPN server config. It is something for a PPP client. PPP clients are responsible for deciding whether or not to create a default route. This is the "Send all traffic" checkbox on iOS.

Your PPP client will always create a route to the remote gateway, plus a route for the remote subnet. Provided that you have IP forwarding enabled on your VPN server (/proc/sys/net/ipv4/ip_forward = 1 plus appropriate iptables rules on linux) your client will be able to send traffic to hosts on the remote subnet.

You must specify proxyarp in the ppp options.xl2tpd file for hosts on the VPN server's LAN to be able to send traffic back to clients. This will create an entry in the arp table and enable the proxy_arp option in the kernel. This allows the VPN server to accept packets on behalf of VPN clients using its own ethernet interface. If you don't want to do this or need to cross routers it appears that putting the VPN clients behind NAT is a popular solution, though I didn't test this myself.

Use the ms-dns ppp option to provide a nameserver for clients if they are going to use the VPN as a default route. Otherwise an iPad will complain that it's not connected to the internet.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.