Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've installed OpenVPN on a client (behind NAT-Router) and a VPS server. The tunnel is established. However, ping is only possible from client to server. The server uses its public IP address on tun0 when trying to ping the client:

13:03:56.766564 IP publicIP > ICMP echo request, id 12279, seq 46, length 64

The routing table seems to be correct:

root@:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface * UH 0 0 0 tun0
184.x.x.x * U 0 0 0 venet0 UG 0 0 0 tun0
default * U 0 0 0 venet0

What's wrong? Why is it using the public IP? (It is a OpenVZ Container).

share|improve this question

Determine the IP address of your tunnel interface with ifconfig or the ip addr command. Based on your routing table I would expect it to be Additional tunnels would be, You should also be able to determine this address from the client's routing table.

Try using the IP address of the servers end of the tunnel in place of in the ping command: ping -I This should force the ping to use the desired address. Some versions of ping will bind to the interface and not be able to send the ping on a different interface.

What your are seeing is relatively common when you run tunnels or other cases where routing may be asymmetric. In this case:

  • Ping from public address gets routed out tun0.
  • Reply from client gets routed out normal interface back to your server.
  • Server doesn't recognize reply because source address doesn't match.
share|improve this answer
Now, when I watch the traffic with 'tcpflow -c -i tun0' I can't even see the packages sent by 'ping -I tun0'!? – chris Dec 1 '12 at 18:19
Okay, with tcpdump I see the sent echo requests. Nevertheless, 'ping -I tun0' also uses the public IP. – chris Dec 1 '12 at 22:51
@chris I've updated my response. – BillThor Dec 2 '12 at 14:50
sorry, it was just an iptables rule which I forgot. – chris Dec 2 '12 at 17:26
up vote 0 down vote accepted

Sorry, it was a iptables rule I forgot.

share|improve this answer
It would be useful if you stated which rule you forgot... I guess it is something like iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE ? – Lekensteyn Jul 3 '13 at 22:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.