Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently have an openVPN server with multiple external IP addresses.

I'd like to have all VPN connections (tun0 interface, and/or 10.19.88.xx IP range) to take the 2nd external IP address as 'public IP', instead of the first one.

As an example, using fictive addresses:

Deault eth0 address: (server.domain.tld)
eth0:0 address: (vpn.domain.tld)

All VPN connections are currently using, instead of

Is there any way to solve this (using iptables?)


share|improve this question
The server is running Debian linux (and is a virtual machine). This server is being used for testing purpose only. – Tuinslak Oct 5 '09 at 11:43
up vote 0 down vote accepted


iptables -t nat -A POSTROUTING -s -o eth0 -j SNAT --to

Or even better ;)

iptables -t nat -A POSTROUTING -s -j SNAT --to
share|improve this answer
-o eth0:0 doesn't seem to be working. Only full interfaces are supported (eth0). Warning: weird character in interface `eth0:0' (No aliases, :, ! or *). – Tuinslak Oct 5 '09 at 11:54
Fixed my answer :) – rkthkr Oct 5 '09 at 12:27
Still not working. '-i' doesn't work with postrouting, and -o eth0 (which I already tried before ;)) still uses the 1st IP address. Thanks – Tuinslak Oct 5 '09 at 12:35
Just drop the -i tun0 then. That should fix it. – baumgart Oct 5 '09 at 13:20

iptables -t nat -A POSTROUTING -i tun0 -j SNAT --to

The issue with rkthkr's response (besides the weird character in interface) is that it would only match packets coming in from the subnet that are ALREADY going out eth0:0 and SNAT'ing them.

By using -i tun0, you're identifying packets only by what interface they come in (I assume that's the only traffic coming in from tun0), and then SNAT'ing it to the proper outgoing IP.

share|improve this answer
I concur fully.. – rkthkr Oct 5 '09 at 12:29
iptables v1.4.2: Can't use -i with POSTROUTING :) – Tuinslak Oct 5 '09 at 13:22
And leaving out -i doesn't seem to change the VPN external IP address used -- but doesn't output any errors. Not to forget, all other services still need to use as 'main' IP. – Tuinslak Oct 5 '09 at 13:24
Yeah, leaving out the -i would make everything SNAT to .2. The second iptables line in rkthkr's answer should work. – baumgart Oct 5 '09 at 14:33
I'm afraid that doesn't change anything. No errors, but my external IP is still the instead of the I'm guessing iptable is instant, and each change doesn't require the VPN-service to restart or something? I can paste you my sample iptables config if that would be of any help. – Tuinslak Oct 5 '09 at 17:47

same problems, iptables -t nat -A POSTROUTING -i tun0 -j SNAT --to not wotking on debian 5

share|improve this answer
Make sure there is no other MASQUERADING rule in iptables. – Tuinslak Nov 2 '09 at 11:06

You can't use "-i interface_name" with POSTROUTING.

-i interface_name --> PREROUTING (from where a packet comes)

-o interface_name --> POSTROUTING (to where a packet goes)

share|improve this answer

Wouldn't it be better to use openvpn options instead of bringing-in iptables?



share|improve this answer
That doesn't (or didn't) work at that time. – Tuinslak Mar 25 '15 at 18:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.