Fixed: It turned out to be a combo of what BatchyX said (missing the route on the remote end), and tinc on the remote side failing to run a -up script (the script wasn't executable).

So now everything works super, thanks for the help everyone :)


My problem is surprisingly difficult to explain, so I'll break it up into smaller pieces, sorry in advance for the long text :)

I have a server at a hosting provider, that has a public ip, this server is running tinc (vpn software).

At home I have two vlans, VLAN1 (my normal subnet for pc's etc, sitting behind NAT), and VLAN20, for my vmware lab. environment.

What I would like to set up, is so that my VLAN20 network, can use the server at the hosting provider as its gateway (its external ip), instead of the external gateway I have at home.

For that I have a server at home, that has two network interfaces, one nic on VLAN1, and one nic on VLAN20.

Lets say I have the following ips:

Server at hosting provider:
Public IP: (eth0)
Private IP:  (tun0)

Network at home:
VLAN1 -  (.1 is the gateway)
VLAN20 -

Network on server at home:
NIC1 (VLAN1) - (eth0)
NIC2 (VLAN20) - (eth1)
Tunnel - (tun0)

I have set up tinc, so that my server at home works over the tunnel, I can ping from the server at home, and from the server at the hosting provider.

In addition to this I have set up so the server at home uses the tunnel for the default gateway, this all works from the actual server at home, my problem is that I cant get clients on the VLAN20 network to access the internet.

So the problem I have is that I cant figure out how to set up routing so that the network uses the default gateway on the tunnel.

The routes on the server at home are these:

root@home:/etc/tinc/vpn/hosts# ip route dev tun0  scope link
default via dev eth0 dev tun0  proto kernel  scope link  src via dev eth0 dev tun0  scope link dev eth1  proto kernel  scope link  src dev eth0  proto kernel  scope link  src

the /1's get added when the tunnel is up with:

ip route add dev $INTERFACE
ip route add dev $INTERFACE

Doing a traceroute from the server at home to

root@home:/etc/tinc/vpn/hosts# traceroute -s -n
traceroute to (, 30 hops max, 60 byte packets
 1  33.681 ms  33.698 ms  33.658 ms
 2  Router_At_Hosting_Provider  34.930 ms  34.907 ms  34.875 ms

So the "tunnel" subnet ( works fine with the default gateway over the tunnel.

This also works fine:

root@home:/etc/tinc/vpn/hosts# traceroute -s -n
traceroute to (, 30 hops max, 60 byte packets
 1  0.032 ms  0.003 ms  0.005 ms

But my problem is this:

root@home:/etc/tinc/vpn/hosts# traceroute -s -n
traceroute to (, 30 hops max, 60 byte packets
 1  * * *
 2  * * *
 3  * * *

If anyone have any pointers to where I should be be looking, it would be really greatly appreciated.

(The full list of the changes done to both servers after a plain debian install, is here http://pastebin.com/r3Vsvycq)

Edit I suck badly at Visio, but here's my attempt at showing what I'm trying to set up: http://i.stack.imgur.com/ff2R6.png (cant put inline yet because my rep isn't high enough).

migrated from networkengineering.stackexchange.com Mar 22 '14 at 19:08

This question came from our site for network engineers.

  • Is this thread going to be migrated (in this case i can post a solution here) or should i wait for a similar post in serverfault? – BatchyX Mar 22 '14 at 18:35
  • Just a bit puzzled from the net i can ping (so that part of the routing works) and from i can ping (via the server on across the tunnel), so that part also works, i just cant combine it, so the can reach the internet through the tunnel. And cant ping (far end of the tunnel), only the "same" end of the tunnel ( works from Must be missing something obvious :( – Peter Mar 22 '14 at 18:56
  • I think the problem is that the remote site does not have a route to via the tunnel – radicetrentasei Mar 22 '14 at 19:51
  • Changed the routes on the box at home to what BatchyX said, and added a route on the remote server, that one can now ping, but not which is a host behind the box at home on that network. – Peter Mar 22 '14 at 21:12

There are several WTF in this configuration:

ip route add dev $INTERFACE
ip route add dev $INTERFACE

Help yourself and replace that by ip route change default dev $INTERFACE. This will remove the default gateway on eth1 and replace it with your own. You might want to also set the prefered source address on that route, by adding src at the end.

If instead you want to keep the default route but add your own over it, then just change the metric of the original default route to 1 or more. When you will add your default route, it will override (but not destroy) the original default route.

Also, the route to when the VPN is up is a bit redundent, since it is already covered by the default route.

What you want as a routing table will look more like this:

default dev tun0 scope link src
default via dev eth0 metric 1 via dev eth0 dev eth1  proto kernel  scope link  src dev eth0  proto kernel  scope link  src

Now this routing table is correct. The only problem now lies in your server do not have a route to so will try to route that though its public interface. The return path is essentially broken, so traceroute works but pings does not.

Just add a route at the remote site to via tun0 and it will be good.

  • Thanks, the weird ip route stuff was mostly after i read: tinc-vpn.org/examples/redirect-gateway but changed it to what you said, and now i got the same route config as the one you listed, still no traffic flowing from yet though, but must be getting closer. – Peter Mar 22 '14 at 21:10
  • Hitting a stone wall, have no idea what I should be googling, the only remaining thing to be done is having the vpn box at home sharing its "internet" (which is running via the tunnel on on interface eth1 ( net) – Peter Mar 22 '14 at 23:15
  • 1
    Seems to work now, did a lot of different route changes / tinc config changes, not sure which specific change did the trick, ill investigate tomorrow, and post findings. – Peter Mar 22 '14 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.