I am trying to set up a double VPN with openvpn 2.3.4, on two Debian 8. Say I have this 'diagram':

client -> A (vpn server 1) -> B (vpn server 2)


  • on A : eth0 with public ip & tun0
  • on B : eth0 with public ip & tun0

The connections between client and A and between A and B work respectively. Also, I cannot connect to server A whenever it is connected to server vpn B.

My guess is that I need a second interface on A in order to have:

  1. client binds his network interfaces to tun0 with the vpn connection initiated with A
  2. server A has an interface eth1 that serves the server-side VPN part and connects with openvpn client to vpn server B with interface eth0
  3. server B manages the connections from A and therefore from client

My question is : am I thinking correctly here ? Except theory, I haven't found any practical explanations about configuring double VPN...

Also, would it be possible to 'split' an interface (on A) into 2 new virtual ones (eth0:0 and eth0:1 for instance) and use them as replacement of eth0 and eth1 as described before ?

Thanks for the help !

EDIT 1: To answer qasdfdsaq and make my question clearer, I want : client connects through VPN tunnel from A -> A connects through VPN tunnel to B -> B manages clients connections

In the end, client should have server B's ip on the internet.

EDIT 2: I think I could actually summarize my problem as so: A and B are Debian 8 servers, where B is running openvpn server. A has one network interface with public ip, eth0, on which I can ssh. I ssh to A and launch openvpn client.

A is correctly connected through the tunnel to B and can access the web via B but, I cannot ssh anymore to A (because I guess that all, meaning here, the only interface I have available, is bound to the VPN connection.

Is there a way to counter this ?

  • You need to be more clear in describing exactly what you mean by double-VPN. Is client connected to A by VPN? or B? Is A connected to B via VPN? Or does the client connect to A and B by VPN simultaneously? Or does it connect to A then VPN to B through the VPN to A? – noitsbecky Jun 24 '15 at 13:28
  • I edited my post, hopefully it makes it clearer ! – Bamse Jun 24 '15 at 13:35

My guess is that I need a second interface on A in order to have:

  1. Correct. You can specify name of TUN/TAP interface by adding to VPN config file: dev tapX or dev tunX

  2. On client use: no bind option or specify other port by adding to server: port 119X and to client remote address:119X

  3. Enable ip forrward @ server 1 & 2.

  4. Setup routing, every fragment of network must be aware of subnetwork existence.

Also, would it be possible to 'split' an interface (on A) into 2 new virtual ones (eth0:0 and eth0:1 for instance) and use them as replacement of eth0 and eth1 as described before ?

I completely missed sense of this.

  • I am wondering if I need a second physical interface on server A: openvpn binds the only interface on A to the VPN tunnel on B and it gets then impossible to ssh to A from internet. About 'splitting' eth0 into virtual ones, I though it could help me solve this problem with one interface. Now, as you see, my understanding of the problem is quite vague and I might use terms I misunderstand completely. Thanks for the help by the way. – Bamse Jun 24 '15 at 13:59
  • OpenVPN will bind to all interfaces (default behavior), that's why you need to use different ports (bind OpenVPN service to different ports). – Michal Sokolowski Jun 24 '15 at 14:01
  • Okay, I've read your edit, I'd accomplish it like this: OpenVPN's gateway redirect @ client, source based routing @ server 1, NAT @ server 2. – Michal Sokolowski Jun 24 '15 at 14:08
  • I've made a second edit. When I connect on client side with openvpn on my server A, A does not respond anymore (I can only access it via some web shell). I think this problem can be simplified to a server A going through VPN to server B and client trying simply to ssh to server A - impossible for me here. – Bamse Jun 24 '15 at 14:39

I've detailed how i made a double VPN in a post here : http://www.optionull.com/2017/01/29/routing-traffic-through-openvpn-multiple-hops/

The setup I've used is:

  1. End point opens a tunnel (tun0) to server A.
  2. End point opens a tunnel (tun1) to server B within tun0.
  3. All traffic is routed through tun1 to the internet.
  • The link is unreacheble today. – 473183469 Feb 27 '17 at 7:57
  • Sorry for that, shouldn't be https, but http. changed in the original response. – yuvalb9 Feb 28 '17 at 9:03
  • Wow, no offence, but you made everything to make your post hard to understand. Would be nice if you will make the routing part more human readable. – Weirdei May 4 '19 at 19:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.