I have an openvpn setup that is working great. There are some 50 clients connected and everything is handy dandy. I need one of these clients to route all traffic trough the vpn. I setup a ccd for that particular client and added the push "redirect-gateway def1" to it. The routing table seems to be updated in the client. I can access all the hosts in the vpn but can't access anything else outside the vpn. When tracerouting from the client, everything goes to the vpn gateway, but after that not further. I believe the culprit is the iptables configuration in the server.

This is the setup

  • I have an openvpn using the subnet 10.170.x.x with the vpn gateway at (VPNGATEWAY)
  • I have different subnet 10.171.x.x that gets its ip assigned via ccd records (this is the admin network and has 3 clients)
  • The client that I want to have all its traffic trough the vpn is (CLIENT)

From (CLIENT) I can ping (VPNGATEWAY). In fact I can ping all hosts in 10.170.x.x and 10.171.x.x. But can't ping

This is the iptables conf

There are a bunch rules and I took out to make it simpler.

:INPUT DROP [1000:900000]


# here were some rules accepting certain ports  22, 80, etc

-A INPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 13 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 30 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 

# this is the client that needs internet thru the gateway
# i've tried to make as permissive as possible but still to no avail

-A FORWARD -j REJECT --reject-with icmp-port-unreachable 

I've additionaly tried adding

iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

But still no work. Any ideas?

  • 1
    Your rule -A FORWARD -s -j ACCEPT isn't stateful. Are you sure you don't need to add a rule to accept packets returning to – Zoredache Mar 29 '12 at 16:35
  • The openvpn server, is it the gateway machine for your network? – cjc Mar 29 '12 at 16:36
  • BTW, if you do a tcpdump on the outside (eth0?) interface of the gateway, do you see the trace,ping,packets, from leaving the system? – Zoredache Mar 29 '12 at 16:36
  • @zoredache i will tryyour suggestion just to make sure. – Ricardo Marimon Mar 29 '12 at 17:59
  • @cjc the openvpn server is a remote server that I would like to act as the gateway to the outside world for that one client. In this case it will be the server and the gateway. – Ricardo Marimon Mar 29 '12 at 18:00

You have these two rules which to permit your traffic. But these rules are probably not what you want.
or at least not only what you want.


Your firewall rule set seems to be designed to be stateful, but these two rules are stateless. You either need to add two rules to handle the traffic in the other direction, or add some state matching.

  • Thanks @zoredache. This is a nice example of: would you please put that comment in the form of an answer... ;-) – Ricardo Marimon Mar 30 '12 at 12:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.