I have openvpn on a remote server, it's Arch Linux. I'm able to connect to it, but there's no internet after I connect, meaning, when I open a browser and trying to load a website, it's getting stock at "looking up..."

No errors on either side. The server isn't behind NAT, as far as I can see, I'm -- a client -- is.

No firewall on the server.

Something related to routing, forwarding I figure?

  • Client machine - Windows or Linux? – Alexander Tolkachev May 19 '17 at 6:07
  • @AlexanderT, linux – Jodarim255 May 19 '17 at 8:05
  • Could you include the client's output? Is should print the routing commands the client tries to execute. – Lacek May 19 '17 at 8:48

When you create a VPN connection between your client and VPN server, a private network is formed between the two, with address starting with 192.168.x.x, 10.x.x.x or 172.16.x.x.

When you want to route traffic from the VPN client to the global Internet, you must use NAT on the server so that it translates the VPN client's private network address to the server's public IP address.

This is independent of the fact that your client's connection is behind NAT or not.

So, in addition to installing the VPN software, you need to add firewall rules for NAT in your server.

| improve this answer | |
  • ok. 1) why particulary 192.168.x.x, 10.x.x.x or 172.16.x.x. ? 2) by firewall rules, do you mean I have to install and turn on firewall? 3) and create forwarding rules via iptables? – Jodarim255 May 19 '17 at 13:58
  • 1
    1) Those are subnets specified in RFC1918 for non-routable private networks. 2,3) Yes. – Tero Kilkanen May 19 '17 at 13:59

I checked your logs and haven't find any problems. But you said that there is No firewall on the server. It could cause problems, because you should enable forwarding for working NAT. Here is output from guide.


In order to configure your ufw settings for VPN traffic first add the following to /etc/default/ufw:


Now change /etc/ufw/before.rules, and add the following code after the header and before the "*filter" line. Do not forget to change the IP/subnet mask to match the one in /etc/openvpn/server/server.conf. The adapter ID in the example is generically called eth0 so edit it for your system accordingly.


# NAT (Network Address Translation) table rules

# Allow traffic from clients to eth0

# do not delete the "COMMIT" line or the NAT table rules above will not be processed

Open OpenVPN port 1194:

# ufw allow 1194

Lastly, reload UFW:

# ufw reload


In order to allow VPN traffic through your iptables firewall of your server, first create an iptables rule for NAT forwarding [3] on the server, assuming the interface you want to forward to is named eth0:

iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

And don't forget to enable forwarding in sysctl

sysctl -w net.ipv4.ip_forward=1
| improve this answer | |
  • if there's no firewall, why on earh woul there be any problem? no nat, no firewall – Jodarim255 May 19 '17 at 10:54
  • @Jodarim255 you don't have internet on your machine? Or you want to pass al your traffic trough VPN? Because during connection it route all traffic to your VPN connection – Alexander Tolkachev May 19 '17 at 11:07
  • these 2 questions are unrelated. "you didn't eat your breakfest? or you're a java programmer?" – Jodarim255 May 19 '17 at 11:59
  • I want to connect to openvpn on the server, what's not clear? of course, I have internet, of course, all traffic will be tunnelled through vpn. – Jodarim255 May 19 '17 at 12:00
  • 1
    It's worth nothing using ufw with nftables can result in weird behavior and things not working properly... In my case, I had NAT and forwarding configured and working fine for years but after a Debian upgrade, packets would go no further than the OpenVPN server. It turns out that Buster defaults to using nftables. Going back to iptables-legacy fixes the issue. – Léo Lam Feb 12 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.