OpenVPN uses wrong IP-Address

Question

I've installed OpenVPN on a client (behind NAT-Router) and a VPS server. The tunnel is established. However, ping is only possible from client to server. The server uses its public IP address on tun0 when trying to ping the client:

13:03:56.766564 IP publicIP > 192.168.11.8: ICMP echo request, id 12279, seq 46, length 64

The routing table seems to be correct:

root@:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.11.2 * 255.255.255.255 UH 0 0 0 tun0
184.x.x.x * 255.255.255.0 U 0 0 0 venet0
192.168.11.0 192.168.11.2 255.255.255.0 UG 0 0 0 tun0
default * 0.0.0.0 U 0 0 0 venet0

What's wrong? Why is it using the public IP? (It is a OpenVZ Container).

Answer 1

Determine the IP address of your tunnel interface with ifconfig or the ip addr command. Based on your routing table I would expect it to be 192.168.11.1. Additional tunnels would be 192.168.11.5, 192.168.11.9. You should also be able to determine this address from the client's routing table.

Try using the IP address of the servers end of the tunnel in place of 192.0.2.1 in the ping command: ping -I 192.0.2.1. This should force the ping to use the desired address. Some versions of ping will bind to the interface and not be able to send the ping on a different interface.

What your are seeing is relatively common when you run tunnels or other cases where routing may be asymmetric. In this case:

• Ping from public address gets routed out tun0.
• Reply from client gets routed out normal interface back to your server.
• Server doesn't recognize reply because source address doesn't match.

Answer 2

Sorry, it was a iptables rule I forgot.