I have two distant places each with a public IP and I want to make the LAN network of these places as if they were one. That is, the machines in place A can communicate with the machines in place B and those in place B with those in place A.

In Place A ( I have a ASUS AC 1200g+ and a Raspberry pi ( with OpenVPN Server. New clients stays in interface tun0 ( ). At this moment, the Client ( Place B ) can communicate with Place A's LAN, only traffic with destination are redirected to the server side.

Now I want that machines in Place A (Server) can communicate with Place B's LAN. I place a Route in my Router that all destination requests with are redirected to the Raspberry Pi VPN Server but the server dont know what to do it that traffic.

In Place B ( I have a ASUS AC86U with ASUS Merlin firmware and I activate the OpenVPN client with "Inbound Firewall" enable option.

Network Schema


I have a similar setup in which the raspberry pi is the client, but that should not matter too much. Disclaimer: It is not the easiest thing to set up.

I am using this /etc/iptables/iptables.rules file to NAT traffic from OpenVPN connections (usually tun0, but tun+ covers all) into the local networks:


-A FORWARD -i eth+ -o tun+ -j ACCEPT
-A FORWARD -i tun+ -o eth+ -j ACCEPT

The OpenVPN configuration requires a so-called client-to-client configuration. These two lines in the servers OpenVPN-config enable the feature:

# use ccd-folder (per host configs)
# routing to office lan:
client-config-dir ccd

The client-config-dir must manually be created underneath the the /etc/openvpn/...-path where your config is. Within that folder you can then create per-host text files. The file naming is important: Double check how OpenVPN calls your client in the system log (e.g. with journalctl -xef --unit openvpn-server@somehost or in the openvpn-status.txt file). The contents of the file is simple:


would configure it to get the same IP every time it connects ( and configures the VPN server to internally route traffic for to the client with the name of this file and IP address. That makes it understandable, why we have no valid network connection yet: That is, because the host system of the VPN server does not know, that the VPN tunnel can be used to route traffic for that network (netstat -rn4). So we have to configure the VPN server again and append:

push "route"

to tell the server, that it should route traffic to and all clients connected to the server should also be informed about the route - the route is pushed to the clients.

For my setup I used the link above, but while writing this answer I found two interesting links regarding the topic:

good luck :)

  • Thank you very much! It Works!! I think that the only thing that was missing to me are the iptables rules. I add that and works fine! Thank you! – Dariko77 Jan 5 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.