Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am attempting to set up an OpenVPN Router so that I may connect my tablet (wireless) and Blu-Ray (wired) to a paid VPN service in another country on Ubuntu 12.10. I have successfully done this using DD-WRT (too slow) and a virtual instance of PFSense (too limited).

I'm new to Linux, but I'm 90% complete with this project. Hardware is 2 wired ethernet ports, one of which is connected to a traditional home router, and a wireless card.

So far I have..

  1. Set up my wireless to act as a true Master Access point using hostapd
  2. Created a bridge (I think) between the Wireless and Local LAN
  3. Set up a DHCP server that is successfully assigning addresses to the bridge - both wireless and wired are getting them.
  4. Set up OpenVPN so that it successfully creates a tunneled connection upon boot.

Current behavior routes all traffic from my Ubuntu machine to the VPN server. The other devices do NOT have any connectivity, and that's the issue.

My Question/Goal:

How do I configure the routing so that OpenVPN only directs traffic from my bridge (devices under 192.168.10.x) through the VPN tunnel and NOT traffic from the actual Ubuntu computer?

OpenVPN sets up some routes automatically, but it seems to ignore the bridge I set up.

I have read a lot of documentation on iptables and route but it makes very little sense to me. Despite multiple tutorials, I still don't understand how to read the results from the route command. I also suspect this can be accomplished with route-noexec and route-up in the OpenVPN configuration file, but nothing has been successful.

My knowledge of where configuration files and settings are is limited. The above tasks took me at least 30 hours of tinkering, so please go easy on me :)



I've posted a solution below that directs the bridge traffic, but it doesn't prevent traffic on the Ubuntu computer from going through the VPN.

share|improve this question
up vote 1 down vote accepted

I'm not sure this is ideal, but it's at least working. In a perfect world, the traffic on the Ubuntu computer would not route through the VPN - only those devices connected to the Ubuntu computer. Anyways, here's the solution..

In the openvpn.conf file

script-security 2
up "/path/to/external/"

In the /path/to/external/ file

iptables -A FORWARD -o tun0 -i br0 -s -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

In the above, tun0 is the tunnel created by OpenVPN, br0 is the bridge between my local wireless and local lan, and is the subnet/DHCP pool for my local lan.

I have no idea what that script does but I cobbled it together from a few sites on Internet Connection Sharing.

I'll leave this answer un-checked in case anyone wants to provide a better one or explain how to prevent traffic on the Ubuntu computer from going through the VPN.

share|improve this answer

Easier to configure the router itself to connect to the VPN server so all devices on your network will go through it. You can do that from the router's software web interface.

In order to allow devices connected to your PC to access the internet, you have to make internet sharing from that PC to others.

share|improve this answer
Easier, yes. But I've already done that and it was too slow. – jbrookover Dec 28 '12 at 0:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.