Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I installed OpenVPN on my dedicated server.
Using Viscosity or Tunnelblick on the client, I successfully connected to this server.

However, after some tests, I realized that not all the traffic generated by the client goes through the server. Rather than using 1000 words to explain it, I made an image :

Image is clickable Screenshot

As you can see, the yellow part on the server side doesn't show any activity. I get the same phenomenon for YouTube videos loading for example.

Here is my OpenVPN server configuration file :

mode server
proto tcp
port 1199
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
tls-auth ta.key 0
cipher AES-256-CBC

push "redirect-gateway def1"
push "dhcp-option DNS"
push "dhcp-option DNS"

keepalive 10 120
user nobody
group nogroup
chroot /etc/openvpn/jail
verb 3
mute 20
status openvpn-status.log

And here is the client .opvn configuration file :

dev tun
proto tcp
remote MY.SER.VER.IP 1199
resolv-retry infinite
cipher AES-256-CBC
ca ca.crt
cert client1.crt
key client1.key
tls-auth ta.key 1
verb 3

Any idea what's wrong ?


I also tried to create the following iptables rule (found on How To page):
iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

It doesn't change my problem. However, I can't see any new rule when using iptables --list

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination   
share|improve this question
can you provide a paste of the routing table of the OpenVPN client before and after connecting. If not, what OS is the client running? – Olipro Apr 17 '13 at 21:53
The client is running Mac OS 10.8.3. How do I get the routing table of Mac OS ? – Pierre Espenan Apr 17 '13 at 21:55
run the command netstat -nr – Olipro Apr 17 '13 at 21:57
Here you go. Before connection: After connection: – Pierre Espenan Apr 17 '13 at 22:08

using Viscosity.. just overwrite the routes getting pushed by the vpn server.. Edit the config of the connection -> networking -> send all traffic over vpn connection

share|improve this answer
I already tried to check this box. The problem remains the same. However, I didn't neither fill the "Default Gateway" nor add a rule. Should I ? – Pierre Espenan Apr 18 '13 at 13:46
up vote 0 down vote accepted

Well, Mike's answer gave me the clue. Viscosity does override some settings.

The solution is to add the redirect command in Extra OpenVPN configuration commands.
To do so, Edit your connection, go to Advanced tab, and add push "redirect-gateway def1": redirect gateway def1 rule in Viscosity

And as Mike said, don't forget to check Send all traffic over vpn connection in Networking tab: Send all traffic over vpn connection in Viscosity

share|improve this answer

To see your nat traffic with iptables use iptables -L -x -n -v -t nat

It will produce an output like so:

Chain PREROUTING (policy ACCEPT 18025 packets, 1535609 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 5580 packets, 335412 bytes)
    pkts      bytes target     prot opt in     out     source               destination
    1575   125569 SNAT       all  --  *      em1             /* */ to:
     833    93632 SNAT       all  --  *      em1              /* */ to:
    6585   477765 MASQUERADE  all  --  *      em1  

Chain OUTPUT (policy ACCEPT 12118 packets, 810032 bytes)
    pkts      bytes target     prot opt in     out     source               destination
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.