I have a VPS Server (hosted in OVH cloud) with Failover IP configured

$ nano /etc/network/interfaces
auto lo
iface lo inet loopback

# Source interfaces
# Please check /etc/network/interfaces.d before changing this file
# as interfaces may have been defined in /etc/network/interfaces.d
# See LP: #1262951
source /etc/network/interfaces.d/*.cfg

auto ens3:0
iface ens3:0 inet static
    address MY_FAILOVER_IP

    # IPFO 1
    post-up /sbin/ifconfig ens3:0 MON_IP_FAILOVER netmask broadcast MON_IP_FAILOVER
    pre-down /sbin/ifconfig ens3:0 down

I follow the tuto of Digital Ocean to install OpenVpn on my server. It's work but now, I want that my out ip is not those of my server but those of my Failover IP.

So, I saw this cmd

iptables -t nat -A POSTROUTING -s ! -d -j SNAT --to-source ipfailover

But, I didn't work, I have always my server ip

The step 8 of digitalocean "Adjust the Server Networking Configuration" We modified the UFW rules so, I tried to adapt it with my request, given it above:

$ nano /etc/ufw/before.rules

# NAT table rules
# Allow traffic from OpenVPN client to wlp11s0 (change to the interface you discovered!)
-A POSTROUTING -s ! -d -j SNAT --to-source MON_IP_FAILOVER

But it doesn't work.

Can you help me ? Thanks

  • Could you share more info? What you receive when try to connect with OpenVPN client? What you see when try to get access trough VPN tunnel, if connection is ok? Commented May 14, 2017 at 20:49

2 Answers 2


Assuming you bought the failover ip from OVH, your iptables rule would allow the system to fix the source address of the packets as far as the host OS is concerned (useful if you have firewall rules blocking other IPs/etc). What do you mean when you say it doesn't work? What are you trying to accomplish? If you're trying to set up load balancing and failover, do you have a separate physical interface? My guess is you should be able to ping the failover ip but you may not be able to specify what ip OVH uses for your outbound traffic, especially if it's over the same virtual interface. (I am assuming that you use an internal address within their network, which they then translate, please correct me if I'm mistaken.)


iptables -t nat -I POSTROUTING -s [VPN CLIENT IP] -j SNAT --to-source [FAILOVER IP]

this one worked for me

  • Hi and welcome to serverfault. please can you provide a more detailed answer? for example by explaining why op configuration doesn't work?
    – bgtvfr
    Commented Oct 24, 2019 at 8:19
  • what do you need to know
    – Tom
    Commented Oct 26, 2019 at 21:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .