Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've installed OpenVPN on a client (behind NAT-Router) and a VPS server. The tunnel is established. However, ping is only possible from client to server. The server uses its public IP address on tun0 when trying to ping the client:

13:03:56.766564 IP publicIP > 192.168.11.8: ICMP echo request, id 12279, seq 46, length 64

The routing table seems to be correct:

root@:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.11.2 * 255.255.255.255 UH 0 0 0 tun0
184.x.x.x * 255.255.255.0 U 0 0 0 venet0
192.168.11.0 192.168.11.2 255.255.255.0 UG 0 0 0 tun0
default * 0.0.0.0 U 0 0 0 venet0

What's wrong? Why is it using the public IP? (It is a OpenVZ Container).

share|improve this question
add comment

2 Answers

Determine the IP address of your tunnel interface with ifconfig or the ip addr command. Based on your routing table I would expect it to be 192.168.11.1. Additional tunnels would be 192.168.11.5, 192.168.11.9. You should also be able to determine this address from the client's routing table.

Try using the IP address of the servers end of the tunnel in place of 192.0.2.1 in the ping command: ping -I 192.0.2.1. This should force the ping to use the desired address. Some versions of ping will bind to the interface and not be able to send the ping on a different interface.

What your are seeing is relatively common when you run tunnels or other cases where routing may be asymmetric. In this case:

  • Ping from public address gets routed out tun0.
  • Reply from client gets routed out normal interface back to your server.
  • Server doesn't recognize reply because source address doesn't match.
share|improve this answer
    
Now, when I watch the traffic with 'tcpflow -c -i tun0' I can't even see the packages sent by 'ping -I tun0 192.168.11.8'!? –  chris Dec 1 '12 at 18:19
    
Okay, with tcpdump I see the sent echo requests. Nevertheless, 'ping -I tun0' also uses the public IP. –  chris Dec 1 '12 at 22:51
    
@chris I've updated my response. –  BillThor Dec 2 '12 at 14:50
    
sorry, it was just an iptables rule which I forgot. –  chris Dec 2 '12 at 17:26
add comment
up vote 0 down vote accepted

Sorry, it was a iptables rule I forgot.

share|improve this answer
    
It would be useful if you stated which rule you forgot... I guess it is something like iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE ? –  Lekensteyn Jul 3 '13 at 22:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.