I would like to achieve to use my openvpn-connection as default gateway for another host in the same subnet. I have 2 Hosts in the same subnet, both of them with Ubuntu Server 14.04.

Host A runs OpenVPN in order to establish a connection to my openvpn-exit-node. This host has been modified in order to allow ip-forwarding.

Host B is a client-app-server and should use the internet-connection through the shared openvn-connection from Host A. As I've setup the gateway-ip of Host B to the IP of Host A, the traffic from Host B now is routed through the openvpn-connection of Host A.

The problem appears as the openvpn-connection on Host A drops (at least every 24hours here in Germany) and reconnects; afterwards Host B uses the default gw from Host A and bypass the openvpn-connection (sometimes until the tunnel is up again and everytime Host B reboots).

The achievement should be, to ensure that Host B gets internet only through the openvpn-connection. Is there any possibility to ensure, that Host B only has access to the internet as long as it uses the openvn-tunnel?

Host A (eth0 ip: (tun0 ip:

  • Installed OpenVPN and configured the client-connection to my openvn-exit-node: works
  • Configured Host A in order to allow ip-forwarding and configured IP Masquerading: works

Host B (eth0 ip: - Changed the default gateway to the ip-address of Host A: works - All traffic uses the openvpn-tunnel on Host A

Problem: Everytime the openvpn-connection drops and/or openvpn reconnects, Host B seems to switch back using the default gateway of Host A. Host B in such a moment should remain without internet-access but instead its using the connection Host A uses to connect to the openvpn-gateway.

Kind regards, D0C


To Achieve this you should use Policy Based Routing; Will allow you create separate independent routing tables, and direct traffic to any routing table based on packet properties like Source-IP.

Create new routing table as follow:

echo "200    OpenVPN" >>/etc/iproute2/rt_tables

Add default gateway to the newly created table as follow:

route add default via OpenVPN-GW-IP table OpenVPN

Allow Host-B to be routed using this routing table:

ip rule add from Host-B-IP table OpenVPN

You also need to add the following routes to the new table:

ip route add dev lo table OpenVPN
ip route add YOUR-Local-Subnet dev DEVICE-NAME table OpenVPN

Update: Use SNAT instead of MASQURADE,

iptables -t nat -A POSTROUTING -s -j SNAT --to-source
| improve this answer | |
  • Hi and thanks for your help; as the ip-address of my openvpn-connection changes from time to time (dhcp from the vpn-service-provider) I'm not sure about which ip is meant with "OpenVPN-GW-IP". Thank you and kind regards, D0C – D0ckW0rka Oct 12 '14 at 16:39
  • I thought you have your own openvpn server, any way OpenVPN-GW-IP: when you are connected to the VPN, your routing table should be changed with new entries added; find out what is the VPN connection gateway, route -n | grep tun and use that ip... this should not be changed as i know VPN IPs are assinged based on the certificate and they do not changed by time ... – MohyedeenN Oct 12 '14 at 17:17
  • Sorry for the misunderstanding - I've didn't mean that I'm the owner of the VPN-Exit-Node; in fact it's a commercial anonymous vpn-provider (there is now certificate in order to identificate but username/password). Even if the ip-address itself changes, the openvpn-gw-ip should always keep the same - I'm gonna test this and let you know. Kind regards, D0C P.S: added the used adresses in the question – D0ckW0rka Oct 13 '14 at 9:55
  • OK, I've done this now The traffic from Host B (after a fresh reboot) goes through the openvpn-connection, but the problem persists. If the openvpn-connection drops (tested by manually restarting the openvpn service), Host B switches to the default gateway of my LAN which should be avoided. Even after the re-up of the vpn-tunnel Host B won't reset to the tunnel-gw. The reset happens only after a restart of the Host B. Kind regards, D0C – D0ckW0rka Oct 13 '14 at 12:50
  • How Come, what is the relation between HostB and the VPN-Restart, the GW of HostB should be set in static way to the local ip of HostA which is a VPN-Client, why would restarting the VPN change the GW of HostB ,, this does not make sense.. – MohyedeenN Oct 13 '14 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.