Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to create star shaped "virtual" LAN with OpenVPN which is not connected to physical network. ie. tap0 packets should not go to eth0. Packet should only go through OpenVPN to connected clients.

This setup works with my OpenVPN testing machine which runs Virtual Box but not on my actual server which is running on top of Xen. Both servers are running Ubuntu Intrepid.


iface tap0 inet manual


mode server
port 1194
proto udp
dev tap
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/servername.crt
key /etc/openvpn/easy-rsa/keys/servername.key
dh /etc/openvpn/easy-rsa/keys/dh384.pem
ifconfig-pool-persist ipp.txt
push .route
keepalive 5 60
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3
user nobody
group nogroup

ifup tap0 on Virtual Box: everything ok, SSH keeps running. But on Xen SSH connection drops and I have to reboot whole machine. What I'm missing?

share|improve this question
Can you post the route table thanks. Also if you have special requirements like needing Ethernet Frames to be tunneled and any other requirements please add them to the question as it does impact how users view the problem. – Silverfire Oct 14 '11 at 4:58
Also that "push .route" line in the openvpn.conf looks wrong – Silverfire Oct 14 '11 at 5:00

Is your virtual box instance bridged to the host operating system? When you say the ssh connection drops in Xen, which ssh connection are you referring to? Do you have another way into the vm so you can see what is actually happening to the networking when the bridge comes up i.e virtual serial console? That would go a long way in helping to solve your issue.

share|improve this answer

why not using tun mode and routing the traffic via central vpn server? should be perfectly doable.

you'll probably want to use '--client-to-client' option.

share|improve this answer
I need L2 packets to be passed – raspi Oct 15 '09 at 5:53

I don't think you want the gateway line in /etc/network/interfaces.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.