I have two networks which I want to connect by an openvpn tunnel (per tun-device).

Server-side network is,
The vpn gateway runs on a VM with the IP,
The vpn tunnel on the vpn gateway side has the IP
The router is a cable router with IP
The router has a route entry to
The router does port forwarding from 1194 to

Client-side network is
The client-side router is a debian raspberry with IP
It is connect to a foreign wlan (wlan0) with an IP from a pool (192.168.0.xx)
Clients are (not yet) connected via ethernet (eth0)
The vpn tunnel has the IP

I established the vpn connection and now would like to route between the nets.
On the client side I added a route by "route add -net tun0"
on the server side I added a route by "route add -net tun0"
The firewall on the server side is all set to ACCEPT.
I have no masquerading or snat configured and I do not want to as I run a service that gets confused when the sender IP in the TCP packet is different than the sender IP it gets in the payload.
Other internet connections should not route through the tunnel.

Now I can ping from the client gateway to server and into the net beyond. http works, too. However, I cannot ping from server to the client gateway nor access any services (like [email protected]). What am I missing?

Thank you for your help.

  • Please clarify (with sample machine names/numbers) which machines are connected with OpenVPN, which are distinct machines on the two networks, and on which machine your NTP service is to be found. Also indicate whether or not the two OpenVPN-connected machines are also listed as default gateways for their respective networks. Please update your question with this information as if you'd provided it originally (ie do not just add a section called "edit" or "update"), and then I can delete this comment. Oct 19, 2017 at 21:18
  • Please edit question with output of ip route and ip route get on the server. If there's nothing suspicious in it, add output of ip rule, too.
    – dirkt
    Oct 23, 2017 at 20:32

1 Answer 1


"route add -net tun0" sends the traffic to openvpn but you haven't told the openvpn server which client to send it to.

To do this we need to use an iroute directive


This should be placed in /etc/openvpn/ccd/<cn> on the server (replace <cn> with the common name on the client's certificate)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .