I'm trying to make my client forward all traffic through a VPS running OpenVPN. As you can see, it will allow pings to both domains and raw IP addresses, but it will not allow traffic like that made through curl and traceroute doesn't come up with anything. The traffic works correctly when not connected to the VPN.

All information is here: https://pastebin.com/tGspNefn

Thank you.

Working configs thanks to solution below:


port <integer>
proto udp
dev tun
ca ca.crt
cert vpnserver.crt
key vpnserver.key  # This file should be kept secret
dh dh4096.pem
tls-auth ta.key 0
ifconfig-pool-persist ipp.txt
push "redirect-gateway autolocal"
push "dhcp-option DNS"
push "dhcp-option DNS"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
status openvpn-status.log
verb 3


dev tun
proto udp
remote x.x.x.x <port number>
resolv-retry infinite
ca ca.crt
cert vpnclient.crt
key vpnclient.key
tls-auth ta.key 1
ns-cert-type server
cipher AES-256-CBC
verb 3
  • /sbin/route add -net netmask gw why netmask ? Commented Dec 1, 2014 at 2:27
  • Thanks DrDinosaur for pointing out serverfault.com/questions/312860/… Commented Dec 1, 2014 at 2:28
  • 3
    Next time extract the relevant information and include it in the question. Pastebin snippets have a limited lifetime.
    – MLu
    Commented Dec 2, 2014 at 22:06
  • here an update considering ipv4 traffic but also ipv6 serverfault.com/questions/408193/…
    – 200313
    Commented Feb 14, 2021 at 20:59

1 Answer 1


There are two parts into the solution:

1. Redirect all the traffic into the tunnel

The easiest solution - use OpenVPN's --redirect-gateway autolocal option (or put it in the config file as redirect-gateway autolocal.

2. Handle the traffic on the OpenVPN server

Now that the tunnel is up all the traffic goes into the tunnel and pops up at the server's end from tun0 interface.

You need to configure two things to make it work:

a. Enable packet forwarding

By default in most distributions the packet forwarding is disabled, hence packets from the tunnel interface never make it to the public interface. You must enable forwarding with:

~ # sysctl net.ipv4.ip_forward=1
net.ipv4.ip_forward = 1

Once tested make the change permanent in /etc/sysctl.conf

Also make sure that iptables are not blocking the forwarded traffic:

~ # iptables -I FORWARD -j ACCEPT

This is good enough for testing - in production you'll want to make the firewall rules a bit more specific, but that's out of scope here.

b. NAT the outgoing packets from the tunnel

With forwarding enabled the packets are by default forwarded with their source address unchanged, that is in your case - such packets are either dropped on the ISP gateway or even if they make it to the destination the reply never finds the way back. These private addresses are not routable on the internet.

The solution is to NAT the egress traffic, i.e. replace the private address with the VPN server's public IP. That will ensure that the replies reach the VPN server and there they will get forwarded back into the tunnel.

~ # iptables -t nat -I POSTROUTING -s -o eth0 -j MASQUERADE

3. Test it

Now try ping from your VPN client. You should see a reply. Let us know if not :)

  • This works perfectly now. Many thanks for the high quality answer.
    – DrDinosaur
    Commented Dec 3, 2014 at 5:01
  • On the client side add add pull to client.conf file, or or add --pull option to command line, so the client would accept configuration pushed by server. Also if the client runs under Windows Vista or newer disable UAC, otherwise openpn service running on client will be unable to set routes.
    – Viktor
    Commented Sep 23, 2015 at 8:35
  • > b. NAT the outgoing packets from the tunnel That was helpful to me.
    – FelikZ
    Commented Nov 14, 2015 at 19:51
  • Really take into account that the FORWARD -j ACCEPT rule makes the Server an open router between all it`s interfaces. It must not be used on production systems. But for an HowTo get it basicly working quickly a very good instruction set. Commented Dec 18, 2017 at 17:24
  • Does the Redirect all the traffic into the tunnel step in Client config ?
    – aircraft
    Commented Sep 2, 2018 at 16:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .