Do I need IP forwarding?

varnav

Hello!

The scenario is to allow multiple clients connect to my server and then route them to number of internal subnets.
I've configured everything according to HOWTO.
I've been able to successfully connect and ping addresses of VPN server, but not addresses of any internal subnets.

I've spent many hours trying to figure out what's wrong, and it seems that one simple command solved my problem:

echo 1 > /proc/sys/net/ipv4/ip_forward

But it's never mentioned in HOWTO in any way? Why? Is it really necessary?

Traffic

varnav wroteBut it's never mentioned in HOWTO in any way?

It is here:
HOWTO: Expanding the scope of the VPN to include additional machines

The HOWTO wroteMake sure that you've enabled IP and TUN/TAP forwarding

TUN/TAP Forwarding is to do with the firewall.

varnav wroteIs it really necessary?

As you said your self:

varnav wroteit seems that one simple command solved my problem:

echo 1 > /proc/sys/net/ipv4/ip_forward

These things take time to learn .. :mrgreen:

varnav

Oh thanks. Looks like I've missed this small but important detail in HOWTO.

BTW ip forwarding is not a firewall thing, it's a kernel option.

varnav

In fact startup scripts included this command in the past, and still may include it in some software packages.
So it may be not necessary as init script may be doing this for you.

Also please note that command will not persist after reboot.

Traffic

varnav wroteBTW ip forwarding is not a firewall thing, it's a kernel option

Traffic wroteTUN/TAP Forwarding is to do with the firewall

and there I was trying to help :roll:

varnav

Do I need to do anything with the firewall? Some manuals recommend to open all connections for tun interface, but for me it seems to work without that.