I am running OpenVPN linking two linux machines on two networks. These machines are not the networks' gateways. There are also separate DD-WRT routers which are acting as the gateways on both networks.

I would like to use this setup to make both networks completely visible and usable to each other over the internet. What types of routes would I need to set up on each box/router to make this possible? Do I need to use any kind of iptables rules (not thinking I would).

Also, just couple points-

  • The link works fine between the two boxes. They are able to ping each other and transmit traffic.
  • I do not want any of the normal internet traffic passed across the VPN- only the traffic intended to go to the specific site.
  • The networks have separate IP ranges and both netmask

I'm stuck and I've tried adding all kinds of static routes on both my linux boxes and the routers and I can't seem to get anything pingable outside of the VPN link. Any help would be greatly appreciated!


I have added the routes on my VPN boxes and DD-WRT routers, but i'm not able to ping anything outside of the machines. I can ping from the VPN client, and vice-versa I'm able to ping from the VPN server, but still nothing else.

I have also enabled IP forwarding in the kernels of both VPN boxes.

Adding Current Routes:

VPN Server: nonpublished static IP eth0 / eth1 / tun0

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface        *      UH    0      0        0 tun0  *      U     0      0        0 eth0   UG    0      0        0 eth1    *        U     0      0        0 eth1   UG    0      0        0 tun0
default         wsip-24-249-108         UG    0      0        0 eth0

VPN Client: eth0 / tun0

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface        *      UH    0      0        0 tun0   UG    0      0        0 tun0    *        U     0      0        0 eth0
default         munch-router         UG    0      0        0 eth0

You will need to add routes to the DD-WRT boxes for the opposite VPN segment pointing at the linux VPN 'gateways'. You will also need routes on those VPN gateways to the other site via the tap/tun interface to the other site.

VPN_GATEWAY_SITE_A# route add SITEB/24 gw tap_ip_of_SITE_B_VPN_GATEWAY

VPN_GATEWAY_SITE_B# route add SITEA/24 gw tap_ip_of_SITE_A_VPN_GATEWAY

Unless you've already done so you will also need to enable routing on the new linux VPN gateway boxes:


# sysctl -w net.ipv4.ip_forward=1
  • Ah- I think maybe the IP forwarding could be the culprit... I am trying that now! – muncherelli Aug 29 '11 at 1:56
  • Still no dice. I have added my routes above if those help at all. I can now ping the internal LAN addresses of the VPN boxes across the internet, but nothing outside of the machines. – muncherelli Aug 29 '11 at 2:22
  • But not the DD-WRT boxes? If you can't ping the DD-WRT box in SITE B from the VPN gateway in SITE A something is still broken in the routing or firewall setup (most likely on the DD-WRT side). The best next step is to get out tcpdump on the LAN interface of SITE B's VPN gateway and see if you see ping packets leaving for the DD-WRT and if you see no response try testing from the DD-WRT next. – polynomial Aug 29 '11 at 2:29
  • I should also add I'm not sure if you can do that with tun interfaces, I've only done this using taps with openvpn. – polynomial Aug 29 '11 at 2:32
  • Well I am 98% there. It looks like I am able to hit everything on both networks from any PC except for on the actual VPN routers. The VPN routers can only see the other respective internal IP address, but not anything else within the other networks. – muncherelli Aug 29 '11 at 3:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.