I'm trying to set a PC as a Router and somehow it's not working correctly. I have following setting:

CLIENT B (with openvpn tunnel to server)

The connection from CLIENT B to SERVER is over internet, but it shouldn't matter here.

Now the issue is as following:

  • I can ping from ROUTER X the SERVER
  • I can ping from CLIENT A the address (CLIENT B) (and with traceroute I can see, that it's going correctly)
  • I cannot ping from CLIENT A the SERVER

and the same in opposite direction:

  • I can ping from SERVER the address (Router X)
  • I cannot ping the address

For me it seems like it has something to do with time to live (TTL), because the packets cannot reach 4th hop, but I didn't find anything about it in internet.

route -n on server UG    17     0        0 tun0 UG    17     0        0 tun0   U     0      0        0 eth1   U     0      0        0 tun0
XXXXXXXX     U     1002   0        0 eth1         YYYYYYYY         UG    0      0        0 eth1

On Client B I added two iptables rules:

-A FORWARD -i eth0 -o tun0 -j ACCEPT
-A FORWARD -i tun0 -o eth0 -j ACCEPT

Do you have any idea, what's wrong? Thanks for any input.

  • You need to provide a lot more information inorder for us to help you. Please include your router x and client b configurations.
    – Ron Trunk
    Aug 13, 2018 at 12:11

2 Answers 2


It sounds like you are missing a route for in one (or both) of two places.

  1. If openvpn is running in "server" mode the internal routing table inside openpvn
  2. On clientB

The issue is, that OpenVPN in tun-mode manages remote networks internally with iroute parameter.

To resolve this problem, it's necessary to change to tap and add following iptables rules:

iptables -A FORWARD -i eth0 -o tap0 -j ACCEPT
iptables -A FORWARD -i tap0 -o eth0 -j ACCEPT

But then we will get tcp over tcp, what can lead to delays. I don't think there are other solutions for routing with OpenVPN.

The issue was mentioned on https://gitlab.labs.nic.cz/labs/bird/wikis/FAQ#dynamic-routing-issues-with-openvpn

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.