This is supposed to be a pretty simple question but I couldn't google a answer for it!

I have a ipsec VPN tunnel established between and (public IPs). The first machine ( has a LAN with gateway Inside this LAN, there is a machine with IP (the gw already has the rules to forward traffic from to

In machine, I'm able to ping normally. That's prove that the VPN is correctly established.

My question is: what I need to do in order to be able to ping machine from I tried to add a route using command:

route add -net netmask gw

but got:

SIOCADDRT: No such process
  • 1
    You'd need to possibly add a brief pic of the network, including what gear models. Some are as a simply as a router on each end with switch ports built in, others have additional routing, firewalls, accelerators, etc. behind each side, so it is difficult to simply supply an answer without seeing what the layout looks like – TheCleaner Mar 1 '13 at 19:21

What about NAT do you nat your traffic with iptables? You shouldn't do it (traffic that goes to you ipsec tunnel should bypass NAT rule, like this:

iptables -t nat -A POSTROUTING ! -d <ipsec_lan> -j SNAT --to-source <ip>

ipsec vpn in linux makes low-level traffic routing and encryption you can see it with

ip xfrm state

Also, try to chose interface for ping source, might help.

  • What is the ipsec_lan here? where do i get it?, what is the --to-source here,? – YumYumYum Oct 4 '19 at 11:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.