Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have successfully set up an L2TP/IPSec server under Server 12.04 LTS, following info from here with a few tweaks from here.

I can connect on my iPhone, get an internal address, and browse the internet as if I'm sitting at my desk at home.

One thing I'd like to do is isolate VPN traffic so that VPN clients can't access anything else in my home network. (Yeah, it sounds strange, but this is strictly for iOS devices only, and really only for when I'm traveling and need my home IP address while on the internet. I have other ways to get to my home computer or file shares.)

The setup is, my home network DHCP range is; the VPN range is So in /etc/ipsec.conf I have the following, which, based on the comments in the file, I thought should limit accessible subnets to just what's on this line:


Additionally, in the [lns default] section of /etc/xl2tpd/xl2tpd.conf I have the following:

ip range =

However when I connect with my phone, I can browse my Plex Media Manager, which is located in my DHCP range. It's that kind of access I'm looking to restrict.

In talking with some friends the first off-the-cuff idea was to use VLANs. But the server is running as a virtual (vbox) on my desktop PC with one NIC so I don't think I can use VLANs here.

The next-best suggestion was to put up some iptables rules to drop traffic not going to but I can't seem to get the rule(s) right - I've been using -A OUTPUT ! -d -j DROP but it seems like there needs to be an exception to that rule and I confess my fluency in iptables is kinda terrible. As soon as I enter that rule by itself, I can no longer make a VPN connection.

I also experimented with using two NICs, one with a static IP of and another with a static IP of 192.168.1.xxx, then change over the conf files to use the .2.1 address; but even after changing the confs and adjusting the port forwarding, I wasn't able to connect. On my router, I did verify that the router itself had access to and that the router's subnet mask was I could ping both NICs from my laptop as well.

I'm kinda bumping into all the walls here. Can anyone give me some pointers on how to isolate VPN traffic from the rest of my network (basically internet only, no intranet), given a virtual installation running in vbox with bridged networking?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.