My home topology:

router1 ( - D-Link dsl2540u server with static IP available from Internet (ADSL via ppoe). 4 LAN ports.

router2 ( - D-Link DIR-300 with OpenWRT. Plays role of WiFi access point. 4 LAN ports + WAN port.

                             Home PC (connects to router1 via DHCP)
internet ------ router1-----
                             router2 (OpenVPN server on OpenWRT)

On router1 I set up NAT Virtual Servers and can connect to my router via SSH or OpenVPN (tcp on 443 port)

DSL-2540u NAT Virtual Servers

OpenVPN server works fine and all traffic goes via tun interface after connection.

OpenVPN server config (if matter):

--script-security 2
mode        server
dev               tun
port              443
proto             tcp

push "redirect-gateway def1"
push "dhcp-option DNS" # Change this to your router's LAN IP Address
push "route" # Change this to your network

client-config-dir ccd
dh                /etc/openvpn/dh2048.pem
ca                /etc/openvpn/CA_cert.pem
cert              /etc/openvpn/certs/server.pem
key               /etc/openvpn/keys/server.pem
crl-verify        /etc/openvpn/crl/crl.pem
tls-auth          /etc/openvpn/ta.key 0
keepalive         10 120
tun-mtu           1500
mssfix            1450
verb              3
log /var/log/openvpn.log

My goal is OpenVPN tunnel with Internet from my home router1. At now I can connect to OpenVPN server but all traffic that goes via tunnel does not reach Internet.

Firewall rules on router2 (OpenWRT):

iptables -t nat -A prerouting_wan -p tcp --dport 443 -j ACCEPT
iptables -A input_wan -p tcp --dport 443 -j ACCEPT

iptables -t nat -A prerouting_lan -p tcp --dport 443 -j ACCEPT
iptables -A input_lan -p tcp --dport 443 -j ACCEPT

iptables -I INPUT -i tun+ -j ACCEPT
iptables -I FORWARD -i tun+ -j ACCEPT
iptables -I OUTPUT -o tun+ -j ACCEPT
iptables -I FORWARD -o tun+ -j ACCEPT

It's definitely a problem with routing but I have no enough knowledges to solve it.

  • 2
    You need to study how NAT works with iptables. Simply adding an ACCEPT rule to the nat table won't make it do NAT.
    – wurtel
    Commented Oct 28, 2014 at 14:44

1 Answer 1


You have to add network routed to gateway as a static route on router1. It's not about NAT.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .