I have questions on the ip packet flow for the following scenario.

The scenario is :

  1. A tun0 ( interface and a physical wireless lan card wlan0 (ip address not fix) on the client side, wlan0 could connect to the internet,
  2. Another tun0 ( interface and a physical ethernet card eth0 ( on the server side (Ubuntu 12.04 amd64), eth0 is on a private network behind a NAT firewall and could connect to the internet through the firewall (firewall as a gateway),
  3. have run "echo 1 > /proc/sys/net/ipv4/ip_forward" on server side,
  4. have run "iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE" on server side,

Here is the diagram of the scenario :

---------------          ----------------
|             |          |              |
| client tun0 |----------| client wlan0 |
|   |          |  ip not fix  |
|             |          |              |
---------------          ----------------


                         |              |
                         |   firewall   |
                         |   (gateway)  |
                         |  |
                         |              |
                                | private network
---------------          ----------------
|             |          |              |
| server tun0 |----------| server eth0  |
|   |          | |
|             |          |              |
---------------          ----------------

I have used two very simple vpn-like client/server programs to read/write ip packets of the two tun0 interfaces and create a tunnel between wlan0 and eth0, so that ip packets from could reach and vice versa (e.g. could run ftp from to

However, if I want to use client tun0 ( to browse webpages, the http request would originate from and destinate at an internet ip address (surely not The http request, (I think) after reaching server tun0 (, would then be forwarded to server eth0 (as ip_forward is on, and I think this forwarded http request would still have a source ip address of, correct me if I am wrong) and in there NAT takes place to repackage the http request as coming from eth0 (i.e. source ip address changes to as I have run the iptables command) and then the repackaged http request goes through the firewall (and then the internet) to its destination.

When the http reply (from the website) reaches server eth0, reverse NAT should take place there. My question is :

  1. would the reverse NAT reverts the destination ip address of the http reply to,
  2. how does server eth0 know where to forward the reverse-NATed http reply ?
  3. would eth0 forward the http reply to server tun0 ( as the reply's destination ip address is reverse-NATed to be ?
  4. do I need to add a route in the server side for proper routing/forwarding of the reverse-NATed http reply ? if yes, how ?
  5. do I need to add some iptables rules in the server side for proper routing/forwarding of the reverse-NATed http reply ? if yes, how ?

closed as too broad by John WH Smith, jimmij, Braiam, jasonwryan, Networker Jan 6 '15 at 19:05

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Although routing and iptables rules could be complex, I ask this question as to clarify some packet flow/routing concepts about the Linux tun interface. My Ubuntu server seems have no rules in its iptables chains and the iptables chains have a default "ACCEPT" policy. Moreover, my server seems have only some default routes for sending outgoing ip packets through the firewall gateway to the internet. – user1129812 Jan 7 '15 at 2:11
  • What I want is to identify what necessary routing and iptables rules SHOULD be applied in my scenario. – user1129812 Jan 7 '15 at 2:16

Assuming that your client sends all of the traffic through tun0, you need to add following on server side (after enabling /proc/sys/net/ipv4/ip_forward):

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT

After this step when you will browse webpages from your client, following will be the packet flow:

  1. Client will send packet to
  2. At server side, packet received on tun0 will be translated from to
  3. A mapping entry will be created in NAT table.
  4. Packet will be sent to internet via (gateway).
  5. Response will be received at
  6. Reverse NAT will occur according to the mapping entry created in step 3.
  7. Response packet will be routed back to

Hope fully I am not missing some major step :)

  • From your step 6 and 7, I understand your statement as that the http reply would be reverse-NATed (at server eth0 according to the mapping entry in step 3) to have a destination ip address of and it would be forwarded to server tun0 ( and then server tun0 would sent the http reply to client tun0 ( through the internet tunnel. Correct me if I have any mis-understanding. – user1129812 Jan 6 '15 at 14:32
  • Yes, thats what I meant. – arshan Jan 6 '15 at 16:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.