Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a weird problem. I am not sure what is happening. We have a server running OpenBSD working as router. This server is also openvpn client and firewall (pf).

From the local network I can't ping an ip from other network:

bash-3.2# ping
PING ( 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1

If you try to tracert this is the result:

traceroute to (, 64 hops max, 52 byte packets
 1 (  4.081 ms  1.560 ms  5.228 ms
 2  *^C

So what I thought was, well there is a routing problem on I connected to that server and I tried to ping that ip:

# ping       
PING ( 56 data bytes
64 bytes from icmp_seq=0 ttl=126 time=131.503 ms
64 bytes from icmp_seq=1 ttl=126 time=132.262 ms

And it works!

This is the tracert:

traceroute to (, 64 hops max, 40 byte packets
 1 (  131.159 ms  131.510 ms  130.967 ms
 2 (  131.523 ms  130.988 ms  130.976 ms

It is going to a diferent network thru the openvpn tunel. If you have a look to the routes they seems to be ok:

# route show |grep 10.21 
10.21/16          UGS        0    34120     -     8 tun0 

(That one route the traffic through the openvpn)

I am not very good at networking. What I am missing?

Always thank you for your help!


PF output for the ping:

# tcpdump -nettti pflog0 host
tcpdump: WARNING: snaplen raised from 116 to 160
tcpdump: listening on pflog0, link-type PFLOG
Dec 17 13:19:08.988094 rule 26/(match) pass out on tun0: > icmp: echo request
share|improve this question
What does the PF rule look like with regards of ICMP traffic? – Alex Dec 17 '12 at 21:06
PF shouldn't be the problem here, even with the PF disable I cannot reach my destination :S (I update the original message with this info) – zordor Dec 17 '12 at 21:15
Is there a firewall on the other side of the tunnel or just a vpn end point? Also, is ip forwarding enabled in OpenBSD? Check in /etc/sysctl.conf you should have the following line: net.inet.ip.forwarding=1 – Alex Dec 17 '12 at 21:21
Yep everything are pass out and pass in at both sides of the tunnel... ip.forwarding is looking good too. – zordor Dec 17 '12 at 22:30
Is your local subnet the same as the remote subnet, or is 172.25 your local? Does your local machine have a route for 10.21? – Robert Dec 17 '12 at 23:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.