Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a weird problem. I am not sure what is happening. We have a server running OpenBSD working as router. This server is also openvpn client and firewall (pf).

From the local network I can't ping an ip from other network:

bash-3.2# ping
PING ( 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1

If you try to tracert this is the result:

traceroute to (, 64 hops max, 52 byte packets
 1 (  4.081 ms  1.560 ms  5.228 ms
 2  *^C

So what I thought was, well there is a routing problem on I connected to that server and I tried to ping that ip:

# ping       
PING ( 56 data bytes
64 bytes from icmp_seq=0 ttl=126 time=131.503 ms
64 bytes from icmp_seq=1 ttl=126 time=132.262 ms

And it works!

This is the tracert:

traceroute to (, 64 hops max, 40 byte packets
 1 (  131.159 ms  131.510 ms  130.967 ms
 2 (  131.523 ms  130.988 ms  130.976 ms

It is going to a diferent network thru the openvpn tunel. If you have a look to the routes they seems to be ok:

# route show |grep 10.21 
10.21/16          UGS        0    34120     -     8 tun0 

(That one route the traffic through the openvpn)

I am not very good at networking. What I am missing?

Always thank you for your help!


PF output for the ping:

# tcpdump -nettti pflog0 host
tcpdump: WARNING: snaplen raised from 116 to 160
tcpdump: listening on pflog0, link-type PFLOG
Dec 17 13:19:08.988094 rule 26/(match) pass out on tun0: > icmp: echo request
share|improve this question
What does the PF rule look like with regards of ICMP traffic? –  Alex Dec 17 '12 at 21:06
PF shouldn't be the problem here, even with the PF disable I cannot reach my destination :S (I update the original message with this info) –  zordor Dec 17 '12 at 21:15
Is there a firewall on the other side of the tunnel or just a vpn end point? Also, is ip forwarding enabled in OpenBSD? Check in /etc/sysctl.conf you should have the following line: net.inet.ip.forwarding=1 –  Alex Dec 17 '12 at 21:21
Yep everything are pass out and pass in at both sides of the tunnel... ip.forwarding is looking good too. –  zordor Dec 17 '12 at 22:30
Is your local subnet the same as the remote subnet, or is 172.25 your local? Does your local machine have a route for 10.21? –  Robert Dec 17 '12 at 23:20

1 Answer 1

You need to check pf.conf rules about block and/or nat rules.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.