Routing from roadwarrior to LAN

NethServer Version: 7.7.1908
Module: Openvpn Roadwarrior

Hi all, i’ve seen this topic pass by a couple of times, and tried to use the solutions that are given, but with no luck.

My setup is: Internet > router( > Nethserver ( - green interface, no bridging or bonding) > roadwarrior vpn (

port forwarding from router to Nethserver (1194)

roadwarrior and firewall applications installed.

Runs on vmware Esxi, with a snapshot taken to revert to a basic install so i can experiment from scratch.
I tried several scenarios, also followed the advice found on this forum to add a static route in my router from to but that didn’t solve my issue.
When i tried a bridged vpn setup, i do have access to my lan, but that uses a tap interface which is not compatible with the Android client, and i really need that.

this is my routing table in Nethserver:

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface UG 0 0 0 ens33 U 0 0 0 ens33 UG 0 0 0 tunrw UH 0 0 0 tunrw

The client connects and i can access the webinterface, but nothing outside the Nethserver.

I also tried Zentyal server (because i am more familiar with that) but i like the implementation on Nethserver better (cert+username possibility)

any ideas would be greatly appreciated.

Welcome to NethServer Community!

Which router do you use?

Here is an example of old firmware not allowing to route through LAN interface:

Hi Markus,
Thanks for the reply, my router is a TP-link Archer C7, with firmware 3.15.3 Build 150511 - the latest build according to their website. There is no mentioning of any bug concerning static routing.
Correct me if i’m wrong, but isn’t the routing between the subnets done in Nethserver? shouldn’t there be some form of NAT connecting both subnets?
That was at least the approach on Zentyal, and it didn’t need to have static routing on my gateway. Or am I really missing out on something here?

Thanks in advance,


Could you post a static route screenshot?

If the router does not know about the VPN it drops the traffic instead of routing it to the Nethserver.

Did you use bridged VPN? Don’t know much about Zentyal…

Hi Markus,
Archer routing table:

Hmmm, that’s the exact point i don’t get. I have set Roadwarrior in routed mode. Am i wrong to think that traffic goes vpn-tunnel > Nethserver > LAN? If this is the case, Nethserver would handle the routing between VPN and lan? Or is the vpn subnet ‘mapped’ on the same lan interface?

I have only one network interface set in in Nethserver, so there is no wan interface.



Nethserver handles the routing perfectly but the router does not know about the VPN.

It’s like

roadwarrior - www - router - nethserver - vpn network

If there’s no static route the router drops packets to/from VPN.

If the Nethserver would be gateway then you don’t need the static route as Nethserver does the routing.

On the other hand, if the main office OpenVPN server is NOT also the gateway, then whatever machine or router which IS the gateway must know to route subnet to the machine which is running OpenVPN.

Hi Markus,

Owkay, thanks i got that!

You were right from the start - it’s most probably a bug in my router. Today i have set up the exact same situation @ work, and on a Vasco AXSguard, i’ve setup static routing in the exact same way.
It worked immediately.

I’m going to insert a second NIC in my Esxi server and go with Neth all the way so might be needing more help soon :wink:

Thanks for your patience and time.


1 Like

I found this:thread of buggy C7:

You may “upgrade” the router with openwrt firmware to get working static routing and much more…

1 Like

I thought about that earlier, to upgrade to dd-wrt, but it only works on hardware version 2 and higher, i have hardware version 1 - so it’s a no go.
For my home it’s quite allright, but sometimes i try to build POC situations at home, and in this specific case that didn’t work out well on this router.

At work it’s already implemented - it was a nescessity since our country goes in lockdown due to the coronavirus and quite a lot of colleages are working from home now.

It does a perfect job! Thanks again.