I have a (tinc) VPN setup with multiple clients that connect to a VPN server that sits on a LAN behind a firewall. I want to expose that LAN to the VPN that server is serving. I've seen a few examples around the net how to configure iptables, but I'd like to configure this setup using FirewallD, and have not yet succeeded.

The VPN subnet is and the local LAN is . The VPN server is at and . The test client is at .

I've ran:

firewall-cmd --permanent --zone=external --add-interface=vpn
firewall-cmd --permanent --zone=internal --add-interface=eth0
firewall-cmd --permanent --zone=external --add-masquerade
systemctl restart firewalld

on the VPN server, and on the client:

route add -net netmask gw

Which returned 100% packetloss. Is there anything I'm doing wrong?

PS: If I run "ping" on the test client I do get replies! Just not the rest of the LAN.

1 Answer 1


Your clients on the other end need the routing information as well, so I believe you'll need to have a gateway set for them to talk the other way around unless your VPN server currently acts as the default gateway on the 192.168.178.x network.

(if your firewall is set up right), the machines on the local LAN would need:

route add -net netmask gw

It would be BETTER to add this rule to your default gateway if at all possible, otherwise each machine would need the static route in order to communicate.

  • Of course! It's nice to know the way back too, Stupid me :) thanks a bunch for this! .. There's one problem though- pinging works fine, I can ping everything in my LAN, but I can't reach them with HTTP or SSH, what could be causing that? I managed to get the route into the default gateway by the way, thanks for the tip!
    – Alex
    Commented Jan 5, 2015 at 23:03
  • I made a new question to resolve that new problem serverfault.com/questions/656492/… . Thanks for the help with this one!
    – Alex
    Commented Jan 5, 2015 at 23:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .