The configuration is as following:

    LAN 1                                     LAN 2
address is not                   
                                  <-->  <-->
    client                LAN                 server

So there is a gateway to network, having the address And there is a client connected via OpenVPN tunnel. The client should be able to access any server in network as if it was in this network. I’ve added a rule in the iptables

iptables -t nat -A POSTROUTING -p tcp -s \
         -d -j SNAT --to-source

that should, in my opinion, translate the source IP address of any packets coming from the OpenVPN tunnel and having destination in the network, to, the VPN server’s own internal IP in that network.

But when I try to mount a CIFS share over VPN, I see in the logs

Denied connection from (
[2016/09/30 16:59:09.395655,  0] lib/access.c:338(allow_access)

So the source IP address is not translated. This CIFS server runs locally on the VPN server, may this be an issue?

  • You might not need to use a NAT (serverfault.com/questions/662542/…). – ysdx Sep 30 '16 at 14:31
  • @ysdx I know what you mean, but setting up NAT once properly is simpler, than adding the VPN subnet to configuration of all services that run in – tijagi Sep 30 '16 at 14:37

POSTROUTING is only used for packets in transit, not for packets intended for the current host. You need to add your NAT rules to the INPUT chain as well if you need them as well for the packets intended to the current host.

See man iptables-extensions:

SNAT: This target is only valid in the nat table, in the POSTROUTING and INPUT chains


POSTROUTING only affects packets after routing. Because the destination is the router itself, no routing takes place, so POSTROUTING is not applied. You are probably looking for PREROUTING, which affects all packets before they are routed.

  • I thought as much, but if I change POSTROUTING to PREROUTING, it doesn’t help. – tijagi Sep 30 '16 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.