My server LAN IP is and there is an intranet web server on The OpenVPN daemon is configured to give clients 192.168.2.* addresses.

There is push "route" line in the config which I expect to enable the VPN clients to access the entire net, but they can only access - the VPN server itself.

I've tried enabling net.ipv4.ip_forward = 1 in /etc/sysctl.conf but this doesn't help.

Any ideas?

PS: The server runs Ubuntu 12.04.
PPS: OpenVPN runs in tun mode over UDP.

  • Dear @FrandsHansen, I only accept answers which at the same time 1. are logically correct answers to the questions, 2. have been tested by me to work.
    – Ivan
    Sep 10, 2012 at 21:08

2 Answers 2


Make sure that the ip forwarding is acutally enabled

echo 1 > /proc/sys/net/ipv4/ip_forward

Also, in order for route push to work, the servers on the inside also needs to know the route to your OpenVPN client IP address. So they will need to know the route to

You can most likely make iptables do the routing via masquerade using

/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
/sbin/iptables -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
  • echo 1 > /proc/sys/net/ipv4/ip_forward gives -bash: /proc/sys/net/ipv4/ip_forward: Permission denied - what does it mean in this case?
    – Ivan
    Aug 16, 2012 at 19:37
  • Most likely it means that you are not doing it as root. Try doing it as root Aug 16, 2012 at 19:59
  • It's just the same effect with sudo. What the result is intended to be?
    – Ivan
    Aug 16, 2012 at 20:14
  • 2
    Putting sudo in front of the command won't add the privileges to the file (after the > ), so you need to elevate to root and then do it. Aug 17, 2012 at 6:46
  • 2
    or use echo 1 | sudo tee
    – ygrek
    Feb 27, 2013 at 3:48

If Your LAN network really is, then you can get a lot of problems. Because most routers have that default network. So, when You are on guest network, Your computer can get an ip from network. So, You cannot access your remote network, but guest network. I suggest choose another network for your LAN and VPN. for example for LAN and for vpn. xx depends on how much vpn clients are connecting to LAN.

here is my fw script for openvpn


iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A INPUT -i tap+ -j ACCEPT
iptables -A FORWARD -i tap+ -j ACCEPT

# Allow packets from private subnets
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -j ACCEPT

# i have multiple vpn networks
# = LAN
iptables -t nat -A POSTROUTING -s -o eth1 -j MASQUERADE
iptables -t nat -A POSTROUTING -s -o eth1 -j MASQUERADE
iptables -t nat -A POSTROUTING -s -o eth1 -d -j MASQUERADE # to single server access only

echo 1 > /proc/sys/net/ipv4/ip_forward
  • No, it's not actually, just 2 different 192.168.#.0 nets. Thank you for the answer.
    – Ivan
    Aug 21, 2012 at 16:34
  • If You need, i can share my openvpn server config and client config.
    – Guntis
    Aug 21, 2012 at 16:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .