Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using Ubuntu and I'm trying to establish a vpn-connection to an Endian server, which seems to be based on openvpn.

I have installed openvpn and connected to the server, using the following command:

sudo openvpn --client --pull --comp-lzo --nobind --dev tap0 --ca /home/tkn/efw.pem --auth-user-pass --remote vpn.domain.tld 1194

The above was suggested in the FAQ for Endian-vpn.

It appears to be working, since I get the following output:

Mon Aug 24 20:58:00 2009 OpenVPN 2.1_rc11 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Mar  9 2009
Enter Auth Username:tkn
Enter Auth Password:
Mon Aug 24 20:58:05 2009 WARNING: No server certificate verification method has been enabled.  See for more info.
Mon Aug 24 20:58:05 2009 LZO compression initialized
Mon Aug 24 20:58:05 2009 UDPv4 link local: [undef]
Mon Aug 24 20:58:05 2009 UDPv4 link remote:
Mon Aug 24 20:58:05 2009 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Aug 24 20:58:05 2009 [] Peer Connection Initiated with
Mon Aug 24 20:58:06 2009 TUN/TAP device tap0 opened
Mon Aug 24 20:58:06 2009 /sbin/ifconfig tap0 netmask mtu 1500 broadcast
Mon Aug 24 20:58:06 2009 Initialization Sequence Completed

However, if I open my browser and go to, I get my own IP - not the remote network. Also, my network manager doesn't list the tap0 device. It's there if I select "edit connections", but I can't select it from the main dropdown.

What am I missing?

share|improve this question
up vote 4 down vote accepted

try putting line


in you OpenVPN config

share|improve this answer
+1, this will add the routing needed to have all traffic going through the vpn. The issue is routes (as stated by others) but openvpn can handle the route tables for you. You need to make sure the vpn server and its external network are setup to allow the vpn traffic out to the Internet, the best way is to make the vpn server a NAT router for the VPN clients, iptables has a rule for it (its in the openvpn FAQ). – Jimsmithkka Aug 25 '09 at 12:47
Thanks - This makes a difference. Unfortunately I can't access anything in my browser now, but from what I can deduce from the comments here, that is probably because the server end doesn't NAT for me? – troelskn Aug 25 '09 at 16:20
OK. The problem appears to be that my dns-server isn't available from the remote net. I fixed this by changing to opendns' nameservers, since --redirect-gateway bypass-dns doesn't appear to work. I guess I could also add a route explicitly for those ips, but this is less manual work. Thanks again for pointing me in the right direction. – troelskn Aug 25 '09 at 16:46

What you want to do is nothing to do with the VPN. What you need to do is set up routing so you go through the VPN.

Moreover, if you want to masquerade your source IP address as the host's, you'll need to set up nat router on the other end as well.

So basically what you'll need to do is:

  1. Set up the client's routing table so that the default route goes through the VPN - but be sure that you still have a route for the specific VPN host that goes through the public network (sending VPN traffic through the VPN would not be cool)
  2. Set up the router at the other end to do source nat for your client's IP address, with appropriate rules.

The router should then NAT the source address on all the outbound packets your client routes through it, replacing its own public IP (masquerading). Then on the inbound packets, it should do the reverse and the packets should come back via the VPN.

share|improve this answer

You're missing either a default route, or a route that encompasses everything you want to use over the VPN.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.