I am trying to implement the following:

  • Network A (e.g. with Router (
  • Network B (e.g. with Router (
  • Online vServer for VPN (e.g. with VPN network (
  • Client A (e.g. on Public Wifi)
  • Client B (e.g. on some other Private Network)

I want that All Networks and Clients to initialize a OpenVPN connection on My Server and all clients should be able to see the other clients/Networks over the vpn.

I also want all internet traffic of the clients (that are no routers) to be routed over the server (For Safe Browsing) and I want also that the clients are able to reach hosts inside the Private Networks "Network A" and "Network B" (and vice versa)

The Networks should only route the data that is addressed to vpn clients and hosts behind the other networks over the vpn as well

I would configure the routers of the networks to route:

  • 192.168.X.0/24 (where X is the own local network) local
  • over the vpn.
  • over the vpn
  • over the internet (everythinge else...)
  • Firewall: NATting to Public IP for Internet, no NATting for VPN

Are my Routes correct?

Now the real Question: How do I set up the OpenVPN server and the Firewall Roules. My Server is a Strato virtual private server with Ubuntu 14.04 64 Bit.

Should I set up NAT as internet gateway for all clients and just ignore the nat on my Routers (routing as described above)? How Do I let the clients communiate with each other? And the most difficult: How do I set up the forewaring of the Packets for hosts inside of the networks over the vpn


Client B <=> VPN <=> Router for Net A <=> Host in Net A 
Host in Net A <=> Router Net A <=> VPN <=> Router Net B <=> Host in Net B
Server that hosts VPN ("internal IP") <=> VPN <=> Some Host behind a router
Server that hosts VPN ("internal IP") <=> VPN <=> Client

# Not that important, but would be cool:
Client A <=> VPN <=> Client B

What else do I neet to set up that i might have forgotten above?

  • The client to client bit: Add client-to-client in OpenVPN main configuration file on the server. Also look at client-config-dir directive. Here you can tell OpenVPN which clients is responsible for which networks. The key word to use is iroute. Like: iroute subnet means the net is accessible from VPN by connecting through the client. IP forwarding has to be enabled on client and client firewall has to allow traffic from VPN to client subnet in order to make it work. – Lasse Michael Mølgaard Jan 17 '20 at 11:41

1Have you enabled IP forwarding?

sudo vi /etc/sysctl.conf #uncomment net.ipv4.ip_forward and set = 1

net.ipv4.ip_forward = 1

sudo sysctl -p

If you are using TUN then there is a tunnel IP address that your client has. The default pool is Unless your router knows about the tunnel IPs and has routes for them, you need to masquerade (NAT) the IP addresses of the tunnels so that the OpenVPN Server will rewrite the source address to be itself. It seems like you may have this covered by your mention of routing

sudo apt-get install iptables-persistent
sudo iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE
sudo sh -c 'iptables-save > /etc/iptables/rules.v4'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.