Community discussions

just joined
Topic Author
Posts: 8
Joined: Tue May 29, 2018 3:54 pm

Acess to subnet behind MikroTik OpenVPN client

Fri Jun 15, 2018 9:58 am

My goal is to be able to connect to private network located behind OpenVPN client ( via OpenVPN server WAN interface.
For example I want this forwarding: http://{Ubuntu WAN IP}:443 --> http://{Private LAN IP behind OpenVPN client }:443
Please take a look at the attached screenshot.
- Ubuntu VPS knows the route to private LAN subnet that is behind OpenVPN client ( and MikroTik router knows the route to OpenVPN subnet (
- I can connect to Ubuntu VPS via SSH and successfully ping MicroTik OpenVPN interface ( and also I can ping any host from MicroTik private LAN subnet that is behind OpenVPN client ( , needless to say the private LAN hosts that are behind OpenVPN client (from subnet) can easily ping Ubuntu OpenVPN interface ( too.
- Also any host from OpenVPN subnet ( if connected to OpenVPN server via OpenVPN client allows communication like http://{Ubuntu WAN IP}:443 --> http://{Private IP of OpenVPN client}:443 using UFW NAT rule.
When I’m trying http://{Ubuntu WAN IP}:443 --> http://{Private LAN IP behind OpenVPN client}:443 I have following behavior:
1) Packets successfully arrive to host behind OpenVPN client (to any host from )
2) But the host of this subnet can't route back this received public IP packet via OpenVPN tunnel, it replies using MiktoTik WAN address.
I would very happy if someone is able to help me solve this incredible puzzle.
As I can guess there are several workarounds:
1) Somehow program router to send back packets with specific port (443) via OpenVPN tunnel
2) Somehow masquerade public WAN interface IP of Ubuntu VPS as private address
Any help is needed.
Forum Guru
Forum Guru
Posts: 4693
Joined: Mon Apr 20, 2009 9:11 pm

Re: Acess to subnet behind MikroTik OpenVPN client  [SOLVED]

Fri Jun 15, 2018 6:53 pm

Two basic options:

a) Quick & dirty, add NAT masquerade on Ubuntu's tun0. You'll loose ability to see original source addresses (everything will look as if it's coming from, but it will work.

b) Proper solution, mark incoming connctions coming from tunnel on MK, add new routing table with default gateway, and mark routing for replies to marked connections, to use this alternative routing table. Replies will go correctly back to Ubuntu and everything will work as it should.
People who quote full posts should be spanked with ethernet cable. Some exceptions for multi-topic threads may apply.

Who is online

Users browsing this forum: No registered users and 71 guests