Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ok, I'm really desesperate I need to release an openvpn deploy to get rid of a dying server. On the subject:

I installed OpenVPN with a routed interface (tun0) into a server with a public IP + 3 private IP networks. I pushed successfully the routes into the clients, authenticated all right, added on the server the iptables rules to do SNAT to the internal networks. And everything seems ok, Except for one thing: The client that generates a TCP request is unable to accept the response from remote servers (on any linux/windows client happens).

Let me dump the info:

[openvnc client addr:] [openvpn server addr:]

[REMOTE-HOST: network:,, openvpn-network:]

No  Source  Destination Protocol    Lenght  hw_src_addr hw_dst_addr src_port    dst_port
1    TCP 60  N/A N/A 57211   22
2  TCP 60  N/A N/A 22  57211
3    TCP 52  N/A N/A 57211   22
4  SSH 73  N/A N/A 22  57211
5    ICMP    101 N/A N/A 22  57211
6  SSH 73  N/A N/A 22  57211
  1. client sends the SYN from a dynamic port (57211) to a remote well known port (22)
  2. server responds SYN+ACK from the well known port 22 client responds ACK establishing the 3 way handshake
  3. server starts ssh protocol information from port 22 as the connection is in ESTABLISHED state client sends a icmp telling the server that the port is unreacheable ( like the server tried to start the connection )

Anyone could get me some pointers please?

share|improve this question
Do you really need to do NAT? This would be much easier without it. – Michael Hampton Aug 17 '13 at 0:05
Yes of course I need to do NAT on a tuned interface. – FarDarkMist Aug 17 '13 at 15:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.