Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to use Google Compute Engine server as VPN server for all my traffic (I'm living in Russia, we have some issues with censorship here).

There is mini-tutorial about VPN on GCE, but it's about network between 2 servers inside GCE and not with OpenVPN.

I've made all steps from another tutorial, about setting up VPN with OpenVPN on Debian, I can connect to VPN from client, but then I can't open connections (can't even ping google). On the server I can ping and download everything as usual.

I have VPN on Linode with same setup and it works fine. So issue is in GCE network routing or firewall rules.

I've tried a lot of variants but nothing works. Please, look at settings and tell me what should I change.


"IPv4Range": "",
"gatewayIPv4": ""


"canIpForward": true,
  "networkInterfaces": [
      "network": "https://www.googleapis.com/compute/v1/projects/jep-ru/global/networks/default",
      "networkIP": "",
      "name": "nic0",
      "accessConfigs": [
          "kind": "compute#accessConfig",
          "type": "ONE_TO_ONE_NAT",
          "name": "External NAT",
          "natIP": ""

Firewall rules:


Internal traffic from default allowed
Source Ranges:
Allowed Protocols or Ports:


SSH allowed from anywhere
Source Ranges:
Allowed Protocols or Ports:


Source Ranges:
Allowed Protocols or Ports:


Source Ranges:
Allowed Protocols or Ports:



Default route to the virtual network.
Instance Tags:
This route applies to all instances.
Destination IP range:


Instance Tags:
This route applies to all instances.
Destination IP range:
Next hop


iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A INPUT -i tap+ -j ACCEPT
iptables -A FORWARD -i tap+ -j ACCEPT


port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS"
keepalive 10 120
status openvpn-status.log
verb 3


share|improve this question
Is there a way to enable ip forwarding? echo 1 > /proc/sys/net/ipv4/ip_forward –  Alec Istomin Apr 23 at 3:31
@AlecIstomin, yes, it's done. I have VPN on Linode with same setup and it works fine. So issue is in GCE network routing or firewall rules. –  OZ_ Apr 23 at 12:31
Maybe ask GCE support? This seems like the sort of thing they could answer quickly. –  Bill Weiss Apr 23 at 13:39
@BillWeiss price for their support plans starts from $150/month, but if this issue will not be solved in week, I think I will pay them. Also I'll try to find somebody on oDesk to fix it and then will write tutorial in my blog. –  OZ_ Apr 23 at 14:06
odesk.com/jobs/~01c4b1438a64f31fdd - don't hesitate to apply, if you can help, guys. –  OZ_ Apr 30 at 13:13

3 Answers 3

Edit /etc/sysctl.conf by uncommenting #net.ipv4.ip_forward=1

That should allow OpenVPN to direct your traffic.

share|improve this answer
A good tutorial on doing it at the following URL: ducea.com/2006/08/01/how-to-enable-ip-forwarding-in-linux –  MFT May 2 at 8:11
it was mentioned in first comment serverfault.com/questions/590530/… –  OZ_ May 2 at 12:28

You need to add rule that allow traffic for OpenVPN itself:

iptables -A INPUT -p udp --dport 1194 -j ACCEPT
share|improve this answer
exist as rule #4 –  OZ_ Apr 22 at 15:29

This is not really an answer, but the site didn't allow me to add it as a comment to your question.

Nevertheless, I have almost the exact same configuration you detailed above (I didn't configure the dnsmaq on the server tough)

Unfortunately, The VPN is not working as expected. I can resolve an address, ping some Internet hosts and even make a complete trace while connected to the VPN. However when I open the browser and navigate to a site, the connection is really slow. I don't know what can be affecting the connection, but is really a strange problem.

Maybe someone from Google can help us know what is going on.

PS 1. As other people has suggested before, can you verify if ip forwarding is enable? For me, the only way to ensure the value for net.ipv4.ip_forward was properly restored after a reboot was after I used a custom rule on /etc/sysctl.d

For example, you can add the rule using the following command:

$ sudo echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/90-useroverrides.conf

PS 2. If the forward works for you, can you test a trace route to a external host while connected to the VPN?. The output I got when I do this is a bit strange (Why there are multiple hops on the same IP ????):

$ sudo traceroute www.yahoo.com -T -p 80 -N 1 -z 0.5 -q 1
traceroute to www.yahoo.com (, 30 hops max, 60 byte packets
 1 (  0.764 ms
 2 (  0.668 ms
 3 (  0.966 ms
 4 (  0.702 ms
 5 (  0.865 ms
 6 (  0.642 ms
 7 (  0.921 ms
 8 (  18.837 ms
 9 (  13.378 ms
10 (  38.275 ms
11 (  13.349 ms
12  *
13  ae-8.pat1.bfz.yahoo.com (  44.903 ms
14  ae-4.msr1.bf1.yahoo.com (  45.323 ms
15  xe-10-3-1.clr1-a-gdc.bf1.yahoo.com (  47.382 ms
16  et18-25.fab6-1-sat.bf1.yahoo.com (  45.793 ms
17  po-13.bas1-7-prd.bf1.yahoo.com (  41.143 ms
18  ir2.fp.vip.bf1.yahoo.com (  42.451 ms

PS 3. The only thing that seems to work properly is the VPN is using the external IP from my host to access the Internet

$ sudo curl --interface tun0 checkip.dyndns.org
<html><head><title>Current IP Check</title></head><body>Current IP Address: 107.178.XXX.XXX</body></html>
share|improve this answer
Thank you very much! Now I can ping and traceroute while connected to VPN. Awesome! Now I will digg how to make this shit work, because only site I can open is checkip.dyndns.org. –  OZ_ May 2 at 12:39
@OZ_ Glad to hear you can now ping and traceroute while connected to the VPN. Now, can you post the result of one of your traceroute?. I'm curious about the first lines of the output because it seems like the package are routed in a loop for at least the first 8 jumps ('m not a network expert,though) –  Mario May 2 at 18:50
sorry, here it is: gist.github.com/jamm/028ae858a03e40495740 . And yes, it looks strange. Maybe we need some specific route. –  OZ_ May 2 at 23:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.