I setup an OpenVPN server on a Raspberry Pi and configured it according to the HOWTO. I want to expose certain hosts from the server-subnet ( the clients.

I used

push route

in the server.conf file. Also I setup iptables the following way:

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

#allow ssh and vpn on pi - working fine

According to OpenVPN - access policies this shoud allow traffich forwarding to either a specific host or the entire subnet (lines extracted from the HOWTO - these addresses are not my actual address ranges):

# Employee rule
iptables -A FORWARD -i tun0 -s -d -j ACCEPT

# Sysadmin rule
iptables -A FORWARD -i tun0 -s -d -j ACCEPT

# Contractor rule
iptables -A FORWARD -i tun0 -s -d -j ACCEPT

Neither of this helps. However if I set


and nothing else, I can see all of the hosts, which I do not want. What am I doing wrong?

Thank you for your help.


Error in layer 8 all along!

I forgot to allow the traffic passing back through my tunneling device.

The solution is

#Set default policy of chain 
iptables -P FORWARD DROP

#allow traffic to route from VPN subnet to specific host in subnet
iptables -A FORWARD -i tun0 -s {VPN subnet} -d {host in server subnet} -j ACCEPT
#allow traffic from host in server subnet back to VPN subnet
iptables -A FORWARD -o tun0 -s {host in server subnet} -d {VPN subnet}

I was inspired by this post here:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.