I'm trying to set up my Pi to act as a VPN client for my corporate network (running OpenVPN).

Right now, I have two Ethernet ports on my Pi -- the builtin one (eth0), and an external USB port (eth1).

Given that I have an internet connection on eth1, would it be possible to set everything up so that any computer connected to eth0 connects directly to the VPN and gets an IP from the OpenVPN server?

If possible, I'd like to be able to add a few "extra" features:

  • A VPN IP for the Pi itself (preferably in a second subnet), so that I can access the Pi itself from my corporate network and send updates/similar to it.
  • A way to have an IP (say routed to the Pi itself so I can SSH and configure the Pi

How could I achieve this setup and have this gateway device?

  • 1
    OpenVPN commonly uses a tun (for "tunnel") virtual interface for this purpose; this works over an existing real interface but will have a second IP (i.e., you do not need to dedicate an eth port completely to it). However, the server must support this mode, so that is something you could check on. OpenVPN is widely used on linux and if you search for that ("openvpn linux", instead of, e.g., "openvpn raspbian" or "openvpn raspberry pi") you should find lots of information.
    – goldilocks
    Commented Sep 3, 2016 at 2:01

1 Answer 1


You can do something like this if you add a few things to your config:

  1. Create a script to run on tun/tap connect as described here. Let's say this calls /usr/local/bin/vpn-up on connect and .../vpn-down on disconnect.
  2. Up will need to turn on routing and set up an IP Masquerade for anything outbound over tap0. See below.
  3. Down will just run the -F line from up to flush the table entry. See below.
  4. I imagine you'll want a DHCP server on eth0 so computers plugged into it will get their ip automatically...

The scripts:

-- vpn-up --
sysctl -w net.ipv4.ip_forward=1
iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -o tap0 -j MASQUERADE

-- vpn-down --
iptables -t nat -F POSTROUTING

Vpn-up will coerce packets going out tap0 to all appear to come from the VPN client IP. I don't think OpenVPN messes with the POSTROUTING table; if it does, this might be trickier. Vpn-down just flushes the rules.

There are also about a bazillion ways to configure OpenVPN, so YMMV depending on your setup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.