I'm trying to set up OpenVPN in bridged mode on Ubuntu Server 12.04. It generally works; I can connect, I get an IP and can ping the OpenVPN server and the default GW, but I can't ping anything else in server's LAN.

Previously I did successfully set up the tunneling with TUN adapter and after adding some iptables entries it worked. I could reach other servers as well. But for various reasons I need TAP.

The OpenVPN server is a standalone machine behind a NAT(router), so it's not the default GW at the same time. It has an IP of

Once I connect with a client I get an IP from the specified range, e.g. and try to ping, e.g. which is another server in that lan, it says host unreachable. The confusing part is, that I CAN ping the OpenVPN server itself at and the GW

When running

tcpdump -nnel -i ethX icmp

On a server while pinging it from the client there is no activity.

Just to mention, when connected to VPN I can browse the internet. When trying to reach the connected client from another server, they can't see it either. Only OpenVPN server can ping clients.

As it is the bridge setup I assume it has nothing to do with routing or iptables or Masquerading. Anyways I tried to enter the usual commands like

iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT


iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s -o eth1 -j MASQUERADE

with changing the eth1 to br0, and tap0 as well, but with no effect. Actually this iptables and route part is difficult to understand for me.

In bridged mode, do I need to have any routing or iptables active to achieve access to all of my servers? Do I need to manually add something like route add default gw dev br0 or anything in that kind to declare a specific route?

How to tell my LAN where to "see" VPN clients?

I quess the problem is, that the openvpn server is not the GW, but I can't put openvpn to my dd-wrt hacked router, it's not supported for my model. How can I set up the openvpn server to work around this problem?


Ok, found out by myself..

While trying to ping all the possible IPs in my LAN while connected to VPN i figured out that the IPs I cannot reach belong to virtual servers (VirtualBox) only.

And then I gave myself a facepalm... I forgot to adjust the bridged NICs in VirtualBox for the virtual servers to br0 instead of eth1, as it was before.

Just for convenience I also enabled Promiscuous Mode, because I read on many threads that Promisucous is a MUST regarding the bridged setup.

Now I can ping eeevrything.
Every day I learn something new :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.