Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got some problems with my OpenVPN setup.

The Setup: -> Ubuntu Server 12.04 -> Two active NIC's: eth0 (default): eth1: x.x.x.x (external ip)

I've managed to get the routing to work so i can connect to the outside world with the eth1 NIC.

holmen@filserver:~$ ping -I eth1 -c 3 www.linuxquestions.org
PING www.linuxquestions.org ( from eth1: 56(84) bytes of data.
64 bytes from www.linuxquestions.org ( icmp_req=1 ttl=50 time=133 ms
64 bytes from www.linuxquestions.org ( icmp_req=2 ttl=50 time=133 ms
64 bytes from www.linuxquestions.org ( icmp_req=3 ttl=50 time=133 ms

--- www.linuxquestions.org ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 133.281/133.336/133.379/0.423 ms
One curious thing is that the "from ip #". It says "from eth1" but that ip is the servers ip on the eth0 iface.


holmen@filserver:~$ netstat -anr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface         UG        0 0          0 eth0
x.x.x.x   U         0 0          0 eth1   U         0 0          0 eth0

But here comes the real problem: When setting up openvpn with the option "local x.x.x.x (eth1 ext ip)" it still tunnels the eth0 interface. And i cant understand why.

OpenVPN settings:


dev tap

proto udp

local x.x.x.x

remote openvpn.anonine.net 1194
remote openvpn.anonine.net 1195
remote openvpn-2.anonine.net 1196
remote openvpn-2.anonine.net 1197
remote openvpn-3.anonine.net 1198
remote openvpn-3.anonine.net 1199
remote openvpn-4.anonine.net 1200
remote openvpn-4.anonine.net 1201


resolv-retry infinite



ca anonine.ca.crt

ns-cert-type server


reneg-sec 0

verb 3

Netstat (tunnel active):

holmen@filserver:~$ netstat -anr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface       UG        0 0          0 tap0         UG        0 0          0 eth0
x.x.x.x   U         0 0          0 eth1 U         0 0          0 tap0 UGH       0 0          0 eth0       UG        0 0          0 tap0   U         0 0          0 eth0

Anyone got any ideas?

share|improve this question

You need to update your iptables with something like this. Where x.x.x.x is your VPN subnet

iptables -t nat -A POSTROUTING -s x.x.x.x/24 -o eth1 -j SNAT --to ip_of_eth1

share|improve this answer
This did not do anything to my config. I have been in touch with a community helper at #openvpn and we concluded that it is pretty much impossible do use this setup with tap devices. – junkyhlm Jan 17 '13 at 9:26
up vote 0 down vote accepted

I've managed to solve this with two main steps:

  1. Choose a service provider that uses TUN interface.
  2. A little bit more table routing

The Table routing

I've read the most useful howto over at http://lartc.org/howto/ and followed the provided steps there.

My setup is now two physical nic (eth0 and eth1) divided over three tables (main, T1 and T2). T1(eth1) routes the default stuff (apache2, ssh etc.) and T2(eth0) is just for rtorrent connections.

It works like a charm. So if you have the same issue read up over at lartc.org and the problem will be solved.


I have not tried this config with TAP interface so I cannot say if it works or not.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.