I'm wanting to establish a static route to a separate subnet, routing through a vpn. Debian linux.

Machine A: vpn IP --> machine b (server) ip

Machine B: 3 network interfaces: eth0 LAN1 (172.x.x.x), tun/tap VPN (, eth1 LAN2 (10.42.0.x).

Machine c: (example)

Eth1 is a shared connection, allowing everything on the 10.42.0 subnet to access the 172.x subnet with iptables forwarding packets and NAT to eth0. Works great.

I want a machine A on the VPN network to be able to access the 10.42.0.x subnet. Basically a static route to 10.42.0.xx to route through from a machine on the 10.1.1.x VPN network.

  • What have you tried to add the route? Which VPN software are you using? What is the error you are encountering when adding the route? – Tero Kilkanen Mar 5 '17 at 18:10
  • @tero route -n add -net (on the OSX client - machine "A") – ideal_ Mar 5 '17 at 21:56
  • What is the output of the command? What is the problem you are having after executing the command? Please add more details to the question. – Tero Kilkanen Mar 5 '17 at 23:07
  • there is no issue with actually adding the route - the problem is it doesn't allow a connection using the route. ie: Can not ping a machine on the 10.42.x subnet. I guess my question is what are the subnet parameters to use when adding a route, given the scenario I initially described, to allow traffic from the 10.0.x subnet to the 10.42.x subnet via (which is conenected to both) – ideal_ Mar 5 '17 at 23:13
  • What does the routing table look like after adding the route? – Tero Kilkanen Mar 5 '17 at 23:17

It sounds like you need to push a route from your VPN server to do that.

For both openvpn and strongswan, the VPN server announces a route to the subnet for all clients which don't have direct access to it.

That route can go via a specific IP from within the VPN pool, but you would need to make it a static assignment (i.e. if you push a route for 10.42.x via, then should always be assigned to the machine that actually has access to 10.42.x.x)

The VPN client through which traffic is going to be routed to reach 10.42.x.x will then need to allow IP forwarding, and have suitable firewall rules to make everything work.

What you basically want is:

[machine C] -> [machine A] -> [machine B] -> 10.42.x.x

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.