Right now whenever I connect to a (commercial) VPN server a tun interface spins up with an inet address assigned to it as well as a peer one (whatever that means).

root@mininet-vm:/etc/openvpn# ip -4 a show dev tun0
33: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    inet peer scope global tun0
       valid_lft forever preferred_lft forever

I'm have two virtual interfaces that I want to have all their traffic pass through the VPN. I can get this to work by routing traffic from these interfaces to tun0 and doing an SNAT to I have tried to assign ips like and to them but I only get response traffic on tun0 when the src is (hence why SNAT worked).

I was wondering it's possible to turn tun0 into a regular subnet so that I can assign more than one clients on that subnet and do this without resorting to NATing.

I have found the topology option on openvpn man page but this option seems to be pushed by the server

subnet -- Use a subnet rather than a point-to-point topology by 
          configuring the tun interface with a local IP address and 
          subnet mask, similar to the topology used in --dev tap and 
          ethernet bridging mode.

I have tried to override it with /usr/sbin/openvpn --topology subnet --pull-filter ignore "topology" ... but it fails when adding the IP:

Fri Dec 28 01:52:47 2018 /sbin/ip addr add dev tun0 broadcast
Error: an inet prefix is expected rather than "".

Is there any other way to get this to work? (unfortunately I cannot control the server this a commercial VPN)

1 Answer 1


If you have no control over the server then you can't do this.

The TUN interfaces handles layer three packets (as opposed to a TAP interface, which handles layer two). The server will have static rules for routing and you wont be able to change this using only client side configuration.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .