Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up a simple VPN server on EC2 (Ubuntu 12.04) with the Android example ToyVpnServer. Its instructions:

// There are several ways to play with this program. Here we just give an
// example for the simplest scenario. Let us say that a Linux box has a
// public IPv4 address on eth0. Please try the following steps and adjust
// the parameters when necessary.
// # Enable IP forwarding
// echo 1 > /proc/sys/net/ipv4/ip_forward
// # Pick a range of private addresses and perform NAT over eth0.
// iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE
// # Create a TUN interface.
// ip tuntap add dev tun0 mode tun
// # Set the addresses and bring up the interface.
// ifconfig tun0 dstaddr up
// # Create a server on port 8000 with shared secret "test".
// ./ToyVpnServer tun0 8000 test -m 1400 -a 32 -d -r 0
// This program only handles a session at a time. To allow multiple sessions,
// multiple servers can be created on the same port, but each of them requires
// its own TUN interface. A short shell script will be sufficient. Since this
// program is designed for demonstration purpose, it performs neither strong
// authentication nor encryption. DO NOT USE IT IN PRODUCTION!

I followed the above but replaced 10.* with 192.168.* since EC2's network has already taken 10.*:

$ echo 1 > /proc/sys/net/ipv4/ip_forward
$ ip tuntap add dev tun0 mode tun
$ ifconfig tun0 dstaddr up
$ iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE
$ ./ToyVpnServer tun0 8000 test -m 1400 -a 32 -d -r 0

I then establish the connection from the Android emulator, which works. When I then attempt a web request from the Android browser, the server gets packets, but they are not forwarded:

$ sudo tcpdump -i tun0 -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
07:41:46.342823 IP > 59997+ A? (32)
07:41:51.347913 IP > 49390+ A? (32)
07:41:56.353276 IP > 49390+ A? (32)

$ sudo tcpdump -i eth0 not host -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

Other state of affairs:

$ ip route
default via dev eth0  metric 100 dev eth0  proto kernel  scope link  src dev tun0  proto kernel  scope link  src

$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 22:00:0a:fc:31:99 brd ff:ff:ff:ff:ff:ff
    inet brd scope global eth0
    inet6 fe80::2000:aff:fefc:3199/64 scope link 
       valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 500
    inet peer scope global tun0

$ cat /proc/sys/net/ipv4/ip_forward 

Any help would be greatly appreciated. Thanks.

share|improve this question
up vote 0 down vote accepted

I debugged this by adding:

sudo iptables -t nat -A POSTROUTING -s -j LOG --log-prefix "blah blah: "

which showed in /var/log/syslog:

Feb  1 10:53:47 ip-10-252-194-250 kernel: [9722772.386808] [UFW BLOCK] IN=tun0 OUT=eth0 MAC= SRC= DST= LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=30129 DF PROTO=UDP SPT=64512 DPT=53 LEN=40

Simply using ufw disable seems to have done the trick.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.