I am having an issue with building a static route that spans 2 different subnets and a vpn connection. My topology looks like this:

  • Host-A: inet netmask broadcast
  • Host-B: inet netmask broadcast

  • Host-C: inet netmask broadcast

I have an OpenVPN connection that is initiated from Host-C to Host-B. The OpenVPN connection is on tun0 with a subnet of so Host-B has a tun0 address of and Host-C has an address of

Host-B has ip forwarding enabled and is doing ip-masquerading on firewalld.

I initiate my vpn connection and can reach Host-A from Host-C without issue. I want to be able to have Host-A reach Host-C as well. To my knowledge to add a static route, you need to have a host on the same subnet as your gateway. Since Host-A and Host-B are on different subnets I added a the subnet to my routing table on Host-A.

My routing table on Host-A looks as follows:

# ip route list
default via dev eth0 dev eth0 proto kernel scope link src via dev eth0 dev eth0 scope link metric 1002 

I then tried to add a route to Host-B which is on subnet as:

ip route add via

But I get the error: RTNETLINK answers: Network is unreachable

I understand that the gateway I'm trying to use here is outside the scope of the subnet that Host-A is in. I added the subnet via above to provide the route that that subnet should take which is inside of but I'm not sure if this is the correct way to handle this case.

My routing table on Host-B looks as follows:

$ ip route list
default via dev eth0 dev eth0 proto kernel scope link src dev eth0 scope link metric 1002 via dev tun0 dev tun0 proto kernel scope link src 

I want all traffic except traffic destined for to continue to exit eth0 via

I feel like part of my issue here is I am missing something in my routing table on Host-A which is why I am getting the Network unreachable error when I try to add a route to

What am I missing here?

  • As the question stands, you've only listed the routes for Host-A and then asked about problems with Host-B. If you're adding routes to Host-B can you please include the route list for Host-B also? – tu-Reinstate Monica-dor duh Jun 26 '19 at 4:46
  • Also, tcpdump is your friend. ;-) Even if you're not getting a response from Host-B that doesn't mean that the packets aren't getting there, they may just be unable to get back. – tu-Reinstate Monica-dor duh Jun 26 '19 at 4:48
  • Its my understanding that packets are not sent yet when doing ip route add. Is that not the case ? – johca Jun 26 '19 at 4:55
  • All these commands take effect straight away. As soon as you add the route successfully (no errors), the packets will go via that route. – tu-Reinstate Monica-dor duh Jun 26 '19 at 4:56
  • So you want to find gateway which is on network via gateway on the default network – tu-Reinstate Monica-dor duh Jun 26 '19 at 5:10
1 is outside the range of

From the IP calculator:

Address:              00001010.00000000.000 00000.00000000
Netmask: = 19    11111111.11111111.111 00000.00000000
Wildcard:            00000000.00000000.000 11111.11111111
Network:           00001010.00000000.000 00000.00000000 (Class A)
Broadcast:           00001010.00000000.000 11111.11111111
HostMin:              00001010.00000000.000 00000.00000001
HostMax:           00001010.00000000.000 11111.11111110
Hosts/Net: 8190                  (Private Internet)

So > and the network is unreachable.

If you make your network that would conflict with your route.

I think you may mean that the via should actually be via

After the Update

So your new route list is:

# ip route list
default via dev eth0 dev eth0 proto kernel scope link src via dev eth0 dev eth0 scope link metric 1002 

And you want to add:

ip route add via

The error you now would get would be different:

Error: Nexthop has invalid gateway.

In other words, you can't do this because the gateway is not local to you, it's someone else's gateway. You need an interface with a source IP that's in the same range as the gateway you're trying to connect to.

Your only source IP address ( wouldn't be in the gateway's range, and if we allowed packets from anywhere then we could, potentially end up with all sorts of holes and loops in our network.

Conversely, how would it get back? The foreign gateway would receive a packet and send it back via it's default route because Host-A wouldn't be local to it, either.

Basically, you're asking the router to remap the source IP, but that's not applicable until it arrives at the first gateway and, by then, it doesn't know the path to get back, since packets don't have a breadcrumb trail.

There are lots of ways to solve this problem, but it depends on the network you want. I'd look into tunnels (tap and tun) or GRE or virtual switches which do these kinds of remapping IPs and tracking foreign connections as though they were local. They create virtual interfaces in the same range as the destination, and that's how VPNs actually work.

Thankfully these solutions are a lot easier than they used to be!

  • Yes, that's why i added – johca Jun 26 '19 at 4:28
  • Yep, but you actually have via You just forgot to add the netmask so it assumed /32. – tu-Reinstate Monica-dor duh Jun 26 '19 at 4:30
  • I was wrong on my previous comment. You are correct on On Host-B my routing table looks like this: default via dev eth0 dev eth0 proto kernel scope link src ` so shouldn't I be using that same subnet? The host I want to use as a gateway is definitely outside of which is where I'm getting hung up. – johca Jun 26 '19 at 4:35
  • Please edit the question to add additional information rather than comments. – tu-Reinstate Monica-dor duh Jun 26 '19 at 4:36
  • sorry, I've updated the original question. thanks. – johca Jun 26 '19 at 4:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.