Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following setup:

  • subnet 1 - with a machine used as NAT and also running an OpenVPN client
  • subnet 2 - 192.168.1/24 with an OpenVPN server (the server in subnet 1 connect here)
  • subnet 3 - that uses the NAT machine (subnet 1) to access the internet, so all non-local traffic is routed there to the eth0 interface

The OpenVPN client creates the tun0 interface and appropriate routing so that I can access machines from 192.168.1/24

[root@ip-10-0-1-208 ~]# telnet 8081
Connected to
Escape character is '^]'.

[root@ip-10-0-1-208 ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    0      0        0 eth0   U     0      0        0 eth0 UGH   0      0        0 tun0 UH    0      0        0 tun0 UH    0      0        0 eth0     UG    0      0        0 tun0

However, when I try the same from subnet 3, it can't reach that machine.

[root@ip-10-0-2-61 ~]# telnet 8081

I suspect that it's because subnet 3 is routed to eth0 on the NAT machine in subnet 1 and it cannot jump to tun0.

What's the easiest way to resolve it? I don't want to use iptables. I can't change the routing from machines in subnet 1 because it's done in AWS and so it works only with specific interfaces. Also, the NAT machine gets its IP with DHCP and so bridging is a bit complicated.

IP forwarding is set on the NAT machine

[root@ip-10-0-1-208 ~]# cat /proc/sys/net/ipv4/ip_forward

Thank you!

share|improve this question
Frankly, if you want a proper answer, you should include the following information: the list of all IP addresses & the routing tables of all affected hosts: the two clients (the working & the non-working), the OpenVPN server, the NAT machine, and any extra IP routers in between them. – Laszlo Valko Nov 9 '13 at 3:25
A little drawing of your network may help! – F. Hauri Nov 9 '13 at 15:52
This seem to be a simple routing problem. You have to inform each host about which one act as a gateway or use nat... – F. Hauri Nov 9 '13 at 15:53
It would help to know wich iptables rule you used to do NAT. – Mauricio López Nov 14 '13 at 15:01
up vote 0 down vote accepted

Since you can not change the routing on subnet 1 and do not want to use iptables one approach would be to create a vpn tunnel from subnet 3 to subnet 2 directly.

In case your gateways for subnet 3 and subnet 2 are linux servers I would use openvpn as well. If it is a firewall device, then create a vpn tunnel using the firewall's software to talk to the firewall of subnet 2.

Of course with iptables and the ability to change routing on subnet 1 the fixes are far more flexible, let me know if you like a solution in that regard.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.