I have a VirtualBox VM running Ubuntu 14.04.3 that I would like to

  1. use as a Gateway router.
  2. connect to an OpenVPN server from this VM, and have all forwarding to the internet via VPN
  3. connect to local machines directly (not over VPN)

I followed instructions from here to setup the forwarding, which worked fine. My iptable rules (in a up.sh file) are

sudo iptables -A FORWARD -o tun0 -i eth0 -s -m conntrack --ctstate NEW -j ACCEPT
sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A POSTROUTING -t nat -j MASQUERADE

The first rule is the one I added to allow forwarding to local resources.

I have a similar down.sh file to tear down the forwarding (or so, I hoped)

sudo iptables -D POSTROUTING -t nat -j MASQUERADE
sudo iptables -D FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -D FORWARD -o tun0 -i eth0 -s -m conntrack --ctstate NEW -j ACCEPT

I also executed the following command to enable forwarding

sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"

In my openvpn config.conf file, I have the scripts set to run via the following commands

script-security 2
up /etc/openvpn/up.sh
down /etc/openvpn/down.sh

On VM startup, the up script is run and traffic is forwarded over the VPN (although the first few packets seem to be sent over the regular connection). To test the down script, I then do,

sudo killall openvpn

It looks like the script is run successfully, as all my iptable rules are removed. However, traffic is now forwarded over my regular internet connection (eth0).

How can I get the traffic forwarding to stop if VPN disconnects or is no longer operational? Ideally, I would like access to local resources at all times and the internet only via VPN (from my client machines).


  • hi, I need same thing, but I can't connect client through ubuntu guest machine. I correctly connected vpn, I can access on Internet in guest machine. I set all rules in iptables as hma suggest. But when set gateway in other clients in my lan, they not have access to internet. I see using tcpdump that nothing incoming to guest machine. Maybe I wrong something in virtual box properties ? I set bridged mode. Any suggest ? this is my question : askubuntu.com/questions/835132/ubuntu-guest-as-vpn-gateway – tulkas85 Oct 10 '16 at 8:57

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.