Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am trying to reroute traffic from specific devices in my house over openvpn. For this, I've created an OpenVPN tunnel between my house wifi router and my server.

Here is my setup:

Wifi router's outgoing interface IP:
Wifi router's openvpn tun0:
Server's openvpn tun0:

My PC                   WiFi                                          Server
                              ,- --.
                             |                                      |  _
 __  _                       '                 .-,(   ),-.          ' |-|
[__]|=|    wireless     ___|_      VPN      .-(           )-.   VPN   |=|
/::/|_|  <- - - - - >  [__...]  < - - - >  (    internet     ) < - >  |=|
                          .                 '-(          ).-'         "^"
                          |                    '-.(  ).-'

Server's iptable configuration:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o tun0 -m state --state RELATED, ESTABLISHED -j ACCEPT
iptables -A FORWARD -i tun0 -o eth2 -j ACCEPT

Wifi router's configuration (with a new routing table openvpn-route):

ip route add default via dev tun0 table openvpn-route
ip rule add fwmark 0x1 table openvpn-route
iptables -t mangle -A PREROUTING -m mac --mac-source aa:aa:aa:aa:aa:aa -j MARK --set-mark 1
iptables -A POSTROUTING -t nat -o tun0 -p tcp --dport 80 -j SNAT --to

Now whenever I access sites from my laptop, I see traffic going to wifi router's tun device and from there to the server. However, the SRC IP address of the traffic is (outgoing interface IP of the wifi router). Because of this, I think the server ignores this traffic.

When I look at how many packets matched SNATing rule to change SRC IP to, I see that count as zero. So that rule is not getting matched for any packet.

How can I fix this?

share|improve this question
I've added an slm style ascii-network-a-gram, to hopefully make things clearer. –  Drav Sloan Sep 10 '13 at 22:59
@DravSloan - looks nice! –  slm Sep 10 '13 at 23:29
Wow!! thanks Drav. –  rugmi Sep 10 '13 at 23:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.