I'm having difficult time setting the correct iptable in order to route OpenVPN traffic to my internal OpenVPN client.

My network is similar to this

           (public IP)|                         |   
{INTERNET}============{ eth1     Router         |
                      |                         |
                      |         eth2            |
                                   | (
                                   |              +-----------------------+
                                   |              |                       |
                                   |              |        OpenVPN        |  eth0:
                                   +--------------{eth0    server         |  tun0:
                                   |              |                       |
                                   |              |           {tun0}      |
                                   |              +-----------------------+
                          |                    |
                          |  Other LAN clients |
                          |                    |
                          |   |
                          |   (internal net)   |

So basically, I want to accept port and forward VPN traffic from router to internal OpenVPN box. Then I want the OpenVPN box take the traffic from eth port and sent it to tun.

Here is what I tried:

iptable on router:

$ iptables -A INPUT -i tun+ -j ACCEPT $ iptables -A FORWARD -i tun+ -j ACCEPT

# Allow udp 1194 # iptables -A INPUT -p udp --dport 1194 -j ACCEPT

# Allow traffic initiated from VPN to access LAN iptables -I FORWARD -i tun0 -o eth2 \ -s -d \ -m conntrack --ctstate NEW -j ACCEPT

Allow established traffic to pass back and forth

iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED \
     -j ACCEPT

Masquerade all traffic from VPN clients -- done in the nat table

iptables -t nat -I POSTROUTING -o eth0 \
      -s -j MASQUERADE

iptable on OpenVPN

Can anyone give me a pointer how I can fix this problem?

  • Why are you accepting UDP input on the router? According to your map, the VPN-server is on a different machine inside the network, you just have to forward and NAT all traffic to UDP port 1194 to your OpenVPN server at Your router doesn't even know the IP range, that's the whole point of VPN.
    – Broco
    Oct 1 '18 at 11:33

If my guess is correct, you are trying to use the 10./8 range from your VPN from outside your public network. That won't work, since you can only route traffic via your public IP address from outside, and only the 192.168./16 range inside your network.

One key element: your VPN server is a normal application inside your network, reachable via the network interface Clients which want to connect to your VPN from outside need to do it via the public IP address and over a port, which is forwarded from your router to your VPN application.

Your router does neither know about the tun interface nor about the 10./8 VPN address range. Both are handled on the OpenVPN box. The encrypted traffic is encapsulated inside IP packets using the 192.168./16 private network, getting NATed at the router.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.