I am trying to set up my openvpn network but I have a problem.

My LAN configuration is as follows:

  • main router Zyxel acting as gateway (vdsl connection) and access point;
  • openwrt router TD-W8970 acting as access point and vpn server (

What I want to do is to create a VPN network with clients that must send internet requests only through my LAN gateway (; in other words, I want that the clients public IP shown on internet is the one of my LAN gateway ( and not the one assigned to them by their ISP.

Here below my openvpn configuration.


user nobody
group nogroup
dev tun
port 1194
proto udp
topology subnet
keepalive 10 60
verb 3
push "persist-tun"
push "persist-key"
push "dhcp-option DNS"
push "dhcp-option DNS"
push "route"
ca /etc/easy-rsa/pki/ca.crt
cert /etc/easy-rsa/pki/issued/server.crt
key /etc/easy-rsa/pki/private/server.key
dh /etc/easy-rsa/pki/dh.pem
tls-auth /etc/easy-rsa/pki/ta.key 0


dev tun
proto udp
remote myserver_xyz.com 1194 udp
resolv-retry infinite
user nobody
group nogroup
ca ca.crt
cert client1.crt
key client1.key
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
verb 3

The openvpn network is established correctly and the client is able to ping vpn server and navigate in Internet.

The problem is that the public client IP shown on Internet is the one assigned by its ISP and not the one of the LAN gateway ( where the vpn server ( / is located.

I tried to perform some changes in server configuration but with no success.

I also tried to put push "redirect-gateway def1" or push "redirect-gateway autolocal" but in this cases the client stopped to navigate in internet at all.

If it is not an openvpn issue, is it an issue related to the correct configuration of IPTABLES?

Can you please help me?

Thanks in advance :)

1 Answer 1


If I have understood your needs, the IP packets of your client should be sent to the client router, then through Internet in a tunnel, to the server router, then back to the Internet.

redirect-gateway def1 seems adequate, but to be sure, it would be better to show us the route ip output on all nodes (client PC, client router, server router). These outputs would make us sure the different route tables are correct. https://openvpn.net/community-resources/how-to/ proposes a local flag depending of your exact configuration.

A masquerading command shoud be put on the VPN server, typically on the server router : iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE where eth0 is the external device (the closest to the Internet). See https://linuxhacks.org/what-is-ip-masquerade-and-how-to-rule-it-with-iptables/ or https://bobcares.com/blog/iptables-nat-masquerade/ You also have to enable forwarding (see these articles).

  • First of all thank you for support. I solved in this way. In openvpn server.conf: push "redirect-gateway def1". In the OpenWRT router hosting the openvpn server: sysctl net.ipv4.ip_forward=1, iptables -I FORWARD -j ACCEPT, iptables -t nat -I POSTROUTING -s -o br-lan -j MASQUERADE. I also deleted from server.conf: push "dhcp-option DNS", push "dhcp-option DNS", push "route". Now I am wondering if I can achieve the same result without using iptables but only using specific openvpn configuration on server and client.
    – Francesco
    Commented Oct 8, 2021 at 19:31
  • If your configuration has 2 networks with the same prefix (, I guess the masquerading is mandatory. This avoids that one packet from one of these networks comes on the second unchanged which would imply routing issues (the destination network believes the packet is from a neighbour and not from the other side of the VPN). I can't insist more. Then keep the masquerading, or change one of the by lets's say a Commented Oct 8, 2021 at 20:10
  • I have no control on client network configuration because the client connects to my vpn from a public network (hotel, LTE dongle, ...). What I can do to avoid routing problems is to change IP configuration in the server lan, avoiding the common 192.168.x.x and preferring something in the middle of 10.x.x.x, lowering the possibility of IP conflicts with the client network. In this case (server lan and client lan with different IP configuration), is it possible to achieve the same result without using iptables but only setting server.conf and client.conf properly?
    – Francesco
    Commented Oct 9, 2021 at 9:11
  • With a single client this would work. With two clients which have the same address range, masquerading is needed. Note that there is the route announcement which should appear somewhere. And you still need a masquerading between all your private addresses and Internet, but I suppose it is done elsewhere. Commented Oct 9, 2021 at 9:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .