Our LAN connects to our office gateway machine (, which is connected to the Internet.

I have setup NAT/Masquerading for this purpose with no issue.

We also use OpenVPN to connect to our data-centre (the OpenVPN server is in the data-center).

Instead of configuring all internal clients directly, I have made our gateway server a client ( of the OpenVPN server (

Our network speed on the VPN is ridiculous, and I can't figure out what is going missing, where.

It is working, but I'm guessing packets are going missing.

Internet mode/router -

Gateway eth1 - (to Internet) eth2 - (to LAN) tun0 - (to VPN)


On the gateway machine...


-A POSTROUTING -o tun0 -j SNAT --to-source
-A POSTROUTING -o eth1 -j SNAT --to-source


-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
# accept everything coming from our LAN (eth2)
-A INPUT -i eth2 -j ACCEPT
# accept everything on the VPN
-A INPUT -i tun0 -j ACCEPT
# reject anything else
-A INPUT -j REJECT --reject-with icmp-host-prohibited

# vpn
-A FORWARD -i eth2 -o tun0 -j ACCEPT
-A FORWARD -i tun0 -o eth2 -j ACCEPT

# allow traffic to flow between the Internet (eth1) and our LAN (eth2)
-A FORWARD -i eth2 -o eth1 -j ACCEPT
-A FORWARD -i eth1 -o eth2 -m state --state ESTABLISHED,RELATED -j ACCEPT

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

  • It is working, but I'm guessing packets are going missing. - Stop guessing, now it is time to collect data. Fire up tcpdump/wireshark, collect data. – Zoredache Mar 5 '14 at 18:10

Its probably not your firewall rules if the connection gets established. Check that you can ping from one gateway to the other, specifying the interface. E.g. ping -I tun0 Try this both ways.

It would be good to see the VPN configuration of both the OpenVPN server and the client. There are several possible explanations:

  • You might be encountering MTU mismatch/compatibility issues.
  • You might be affected by traffic shaping by your ISP depending on the ports used.
  • Are you using a proxy server?
  • What are the routing rules (check "ip route")?
  • Performance varies by protocol in different situations. OpenVPN over UDP gives the best performance.
  • Try both tunnel mode (TUN) versus bridging mode (TAP). These are explained on the OpenVPN site.
  • Try turning off compression on both sides.
  • Check that you're using the latest/same version of OpenVPN on both sides.

Use something like speedtest.net on each gateway side without the VPN in place. Once the VPN is established, measure the speed again from gateway to gateway, to rule out LAN troubles on either side.

Last but not least, I suppose you don't want the LAN clients' Internet access to be routed through the other site? If you only want the VPN for site to site traffic, and not internet access, then the OpenVPN client should be configured not to change the default gateway to send all traffic. The routing rules should only redirect traffic bound for the other site through the VPN. The default gateway remains the original ISP connection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.