So far I have successfully created a virtual link between server A and server B using an unencrypted openvpn tunnel. I am trying to route some of server B's traffic through server A. Server B has 5 external IPs and I would like to add 5 local vpn IPs that redirect traffic to 5 IPs at server A, which would give server B 10 distinct outgoing IPs to the world. Obviously some routing needs to be done on both servers but I'm not getting anywhere after a day of googling and reading.

I did

ip route add default via dev tun0 table vpn_table
ip rule add from table vpn_table
ip rule add to table vpn_table
ip route flush cache

on server B, and the same on server A but with IPs swapped. However, on server B when I do wget --bind-address= somewebsite it's not working, I guess because server A doesn't know what to do with the request.

Could anyone point me in the right direction?


Someone suggested that server A doesn't need ip rules, so the situation I have right now is:

  1. setup openvpn link
  2. on server B I do the four ip command mentioned above

I think I'm still missing some routing info on server A. This is what tcpdump on server A outputs when I do wget --bind-address= http://www.cnn.com on server B:

tcpdump: WARNING: arptype 65534 not supported by libpcap - falling back to cooked socket
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
07:11:58.787908 IP > S 2416144580:2416144580(0) win 14600 <mss 1410,sackOK,timestamp 858359606 0,nop,wscale 7>
07:11:59.786129 IP > S 2416144580:2416144580(0) win 14600 <mss 1410,sackOK,timestamp 858359856 0,nop,wscale 7>
07:12:01.788535 IP > ICMP host unreachable, length 68
07:12:01.788545 IP > ICMP host unreachable, length 68

Wget on Server B says

Connecting to www.cnn.com (www.cnn.com)||:80... failed: No route to host.

EDIT 5/19/2014

Added SNAT on server A, right now tcpdump on server A is giving me ( = www.example.com, = server A's external IP that is now the source of packets coming from

09:29:44.114475 IP > S 717252699:717252699(0) win 14600 <mss 1410,sackOK,timestamp 903625938 0,nop,wscale 7>
09:29:45.113546 IP > S 717252699:717252699(0) win 14600 <mss 1410,sackOK,timestamp 903626188 0,nop,wscale 7>
09:29:47.116587 IP > ICMP host unreachable, length 68
09:29:47.116668 IP > ICMP host unreachable, length 68
09:29:47.119289 IP > S 717252699:717252699(0) win 14600 <mss 1410,sackOK,timestamp 903626689 0,nop,wscale 7>
09:29:50.120591 IP > ICMP host unreachable, length 68

So it looks like SNAT on server A is working but somehow it is unable to connect to the requested website. Server A iptables list:

SNAT       all  --             anywhere            to:

Server A ip rule list:

0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default

Part of server A 'route -n':

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface UH    0      0        0 tun0

Could the gateway being have something to do with it?

  • 1
    This is not a pure routing issue. You cannot communicate with the rest of the world using There has to be some NAT. So what does the other system do with the packets? You can track them with tcpdump -i tun0 -n. May 16 '14 at 22:14
  • @HaukeLaging I have edited my original post with tcpdump info
    – Martin
    May 17 '14 at 5:24
  • You should not use route -n but ip route. I guess the doesn't matter because tun0 is a POINTOPOINT connection. Probably the just means "no gateway IP has been set". I must admit I have no idea what's up there. May 19 '14 at 8:08
  • Ok, thanks. FWIW, here's part of the ip route output: dev tun0 proto kernel scope link src
    – Martin
    May 19 '14 at 8:12
  • @HaukeLaging Got it working, thanks a lot for your help! Problem was I had added some of the IPs on server A to eth1 which I just found out is not physically connected to the switch at the ISP :-/ . Re-added the IPs to eth0 and it's working now.
    – Martin
    May 19 '14 at 12:52

There are several problems:

  1. It doesn't make sense to route packets to where they come from. I.e. the

    ip rule add from table vpn_table

    must be left out on server A (ip rule add to... is not necessary either); server A has "normal" routing. You need such a rule on server B (for B's IP address), though.

  2. You need SNAT on server A. Something like

    iptables -t nat -A POSTROUTING -s -j SNAT --to-source
  • Ok, thanks. Not quite working yet, see my edits above.
    – Martin
    May 19 '14 at 7:50
  • @Martin Is routing enabled on server A at all? cat /proc/sys/net/ipv4/ip_forward + iptables -L FORWARD -nv May 19 '14 at 7:56
  • IP forwarding is on (cat /proc/sys/net/ipv4/ip_forward results in 1). iptables -L FORWARD -nv Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
    – Martin
    May 19 '14 at 8:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.