I'm a quite new in the network my internet acces have a proxy so to by-pass it I use a VPN hosted on my VPS. I use the OpenVPN Client software for all my devices. (Windows, Android, Linux)

I got a Raspberry Pi and i would like to use it like a VPN client and forward the VPN connexion I want that complely transparency for user in my home. (I don't want that my familly have to set a gateway and DNS). I did a little schematic for understanding my goal.

Schematic of the project

But I'm block, I configure a DHCP Server on the eth1 (the link between the Pi and the Router), I get an IP adress from the Pi (I try with a laptop before plugin the router). After that, I have some issue to forward the traffic beetween the VPN interface (tun0) and eth1.

This is my iptables rules: IP Tables Rules

The build in ethernet port of the RasPi eth0 is connected to the proxy and the ethernet port eth1 from the dongle is connected to the router. I need NAT to get IP adresses for the devices which will connect to the ethernet through the VPN (eth1) (I guess? ). I know the address of the proxy and the port. I can set static routes on my LAN not before the Pi. The ethernet port and the wlan on the router are bridged. I want to desintall all the VPN Client. The devices get the IP from the first with a DHCP server on eth1, but after from the router. VPN without RasPi works, I even connected to the VPN with a PI.

As I said before, I'm new in the network so it probably that I missed some thing or don't even understand at all.

Thanks in advance for your time

  • you may have better luck if you post your question on a linux iptables website .... as it stands now, your question is not really related to the RPi
    – jsotola
    Aug 24, 2018 at 20:51
  • Just to understand it right: your home network (Windows, Android, Linux) is the WLAN from the router. There is an ethernet cable connected direct from the router to RasPi to proxy, nothing else, right? At first glance it seems NAT and/or routing is on the wrong side. Why do you need NAT? Do you have access to the proxy? Can you set static routes there? Is the ethernet port and the wlan on the router bridged? Do you want to deinstall the VPN client on all your devices? How get the devices their ip address? From the router by DHCP? VPN without RasPi works, isn't it?
    – Ingo
    Aug 24, 2018 at 21:09
  • Do you use a Raspbery Pi 3B+ with Raspbian Stretch Light 2018-06-27?
    – Ingo
    Aug 24, 2018 at 21:20
  • Where I live, they give me internet connexion with a proxy (eth0) and block many thing (Facebook, Messenger, etc) I can install openvpn easly but I want somethink transparent for my familly. They often use WIFI instead of LAN. The goal is to have internet connexion through the VPN (eth1) and plug anything on it (it will be router) and get internet with the VPN. I used a raspberry pi 2 B Aug 24, 2018 at 21:25
  • I try to help you but I need some answers to my questions. What you say gives an overview but I have much to guess about the detailed setup. Can you please reply with "yes" or "no" to each of my question?
    – Ingo
    Aug 24, 2018 at 22:59

1 Answer 1


Here I have made an ascii art how it should work.

                                          /           vpn-tunnel       |          |      \
             bridge                   (tun0) =============\\   //========================\\
DEVICE ~.~.> ROUTER -------> (eth1)RPI(eth0) ------------> PROXY <---> | INTERNET | <---> VPN-SERVER
     \ wifi    D    ethernet  /           \    ethernet   /       wan  |          |  wan /
  (by dhcp)    H     +----------+

The RPi works as a router. Its port eth1 is on the same subnet than all other devices because it is bridged to the wifi on the router. The RPi needs a static ip address on eth1 because it must be addressed as default gateway to the vpn tunnel. The Raspberry Pi B2 has no build in wifi so we need the router.

Setting up a VPN is out of scope here. I assume you can start a VPN client on the RasPi and get a connection to the VPN server with interface tun0.

For the first setup you should also don't set any rules in iptables and leave it complete transparent. iptables is a firewall and only restrict connections. When the network is running then you can setup your firewall step by step.

I use systemd-networkd because the setup is somewhat sophisticated and I think it is the best choise for it.

For reference I use Raspbian Stretch Lite 2018-06-27 updated with sudo apt update && sudo apt full-upgrade && sudo reboot.

Setup systemd-networkd

For detailed information look at (1). Here only in short. Execute these commands:

# disable classic networking
rpi ~$ sudo -Es
rpi ~# systemctl mask networking.service
rpi ~# systemctl mask dhcpcd.service
rpi ~# sudo mv /etc/network/interfaces /etc/network/interfaces~
rpi ~# sed -i '1i resolvconf=NO' /etc/resolvconf.conf

# enable systemd-networkd
rpi ~# systemctl enable systemd-networkd.service
rpi ~# systemctl enable systemd-resolved.service
rpi ~# ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

Configure static interfaces


There are two static interfaces eth0 and eth1 given by the hardware. We configure them by creating these two files. You can just copy and paste this in one block to your command line beginning with cat and including EOF (delimiter EOF will not get part of the file):

rpi ~# cat > /etc/systemd/network/04-eth0.network <<EOF



rpi ~# cat > /etc/systemd/network/08-eth1.network <<EOF



You must configure the DHCP server on the router to give the default gateway to its devices otherwise routing will not work. Because we want to route traffic from eth1 to eth0 and further on we have to enable ip forwarding.

We need the public ip address from the vpn server in the internet because we will connect our vpn tunnel to it. But we set the destination ip address with prefix /32 so that packets only to the vpn server will go to the proxy as next hop. All other destination ip addresses must go through the vpn tunnel, means the default route will be set to the end of the tunnel (see later).

Configure virtual private network


We need two systemd units for the dynamic virtual interface tun0. For example I use openvpn to create the virtual private network. First start the program. Create a new unit with:

rpi ~# systemctl edit --force virtual-private-network.service

In the empty editor insert these statements, save them and quit the editor:

Description=virtual private network

ExecStart=/usr/sbin/openvpn ovpn.conf


Next unit is for NAT (masquerade) and for setting the default route if needed:

rpi ~# systemctl edit --force masquerade-tun0.service

In the empty editor insert these statements, save them and quit the editor:

Description=masquerade tun0

# check if tun0 is available otherwise startup must fail
ExecStart=/bin/bash -c '/sbin/ip link show dev tun0 >/dev/null'

ExecStartPost=/sbin/ip route add default via dev tun0
ExecStartPost=/sbin/iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

ExecStopPost=/sbin/iptables -t nat -D POSTROUTING -o tun0 -j MASQUERADE
ExecStopPost=/sbin/ip route del default via dev tun0


Enable the new services:

rpi ~# systemctl enable virtual-private-network.service
rpi ~# systemctl enable masquerade-tun0.service

That's it.


You can edit the units again with:

rpi ~$ sudo systemctl edit --full virtual-private-network.service
rpi ~$ sudo systemctl edit --full masquerade-tun0.service

First we have to start the VPN client with systemd. I have tried not to do it and start it otherwise but then systemd has problems to check the status of the virtual dynamic interface tun0 we need for network address translation (NAT - masquerade). The unit virtual-private-network.service does not do any special. It just starts the VPN client. You can simply adjust ExecStart= and the environment to start your VPN client.

Because of the nature of systemd it is not possible to ExecStartPost= NAT (masquerade) together with startup of openvpn in virtual-private-network.service. It starts openvpn and goes on but it takes a time until tun0 is up. ExecStartPost= will fail complaining tun0 doesn't exist. So we have to make another unit that depends on the existing interface.

I assume there is no possibillity to configure the VPN server and setup up static routes there. Then we have to fake it whith NAT so it believes that all packets come from the RasPi. We do it with the unit masquerade-tun0.service. Essential is the entry WantedBy=sys-subsystem-net-devices-tun0.device. It binds the unit to the dynamic interface tun0. You can find this .device simply with systemctl when its up. We also set the default route because all traffic shall go through the VPN tunnel. Please look with ip route show what routes your VPN client sets. If it already sets the default route through the tunnel then you should not set it again in masquerade-tun0.service. The unit also cleans up the settings when the VPN client is stopped. You can now start/stop the VPN client with:

rpi ~$ systemctl [stop|start|restart] virtual-private-network.service

[1] Howto migrate from networking to systemd-networkd with dynamic failover

  • Yeah but i need the router because I got the RPi 2 so there aren't WIFI natively. I could buy an WIFI adapter indeed. Aug 28, 2018 at 11:45
  • @Misteralex007 we will use the router
    – Ingo
    Aug 28, 2018 at 13:08
  • Thanks so much, I will try soon as I can. I will keep you in touch. Sep 3, 2018 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.