Our scenario: We've got an OpenVPN server installed on a GKE pod with VPN clients that want to connect to our VPN. We need to expose to clients a service on another pod in our GKE cluster (an MQTT adapter specifically). Address is a private IP on our GCP VPC, pointing to the MQTT adapter pod (please have a look at the image below).

Network scenario

A snippet of our server conf is:

ifconfig-pool-persist ipp.txt
push "route"
push "route"
push "route"
topology subnet

sndbuf 0
rcvbuf 0
push "sndbuf 0"
push "rcvbuf 0"

A route print of a Windows client connecting to our OpenVPN server is

 Network address        Mask            Gateway         Interface    Metric

     35         On-link    281         On-link    281         On-link    281    281         On-link    331         On-link    331         On-link    331         On-link    271         On-link    271         On-link    271         On-link    291         On-link    291         On-link    291         On-link    331         On-link    281         On-link    291         On-link    271    281    281         On-link    331         On-link    281         On-link    291         On-link    271

Our issue: client connects to VPN successfully but it can't reach the MQTT pod. We suspect we lack of some config on K8S side to make OpenVPN pod reach MQTT adapter POD

  • What OS are you running on your clients? If they're running linux, can you show the output of ip route after establishing a successful VPN connection?
    – larsks
    Sep 16 at 20:33
  • @larsks I've put the information needed in the issue description. Hope this helps Sep 19 at 13:16
  • what's your GKE subnet? you may want to add it to your OpenVPN server configuration, e,g, push "route".
    – mforsetti
    Sep 22 at 6:13
  • @mforsetti updated the post...we have added two more routes to our server conf with no success at all. During our troubleshooting we noticed that we can establish a telenet session between OpenVPN pod and the MQTT adpater one with success...but it's suddenly closed after connetion has been established. We will investigate with a tcp dump soon, hoping it could be related to this issue too Sep 22 at 7:38
  • any updated routing table on your client, since it seems that the routes are not pushed to client?
    – mforsetti
    Sep 22 at 9:31

1 Answer 1


To fix the scenario we modified iptables in the OpenVpn pod:

iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

enabling IP Masquerading

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.