I have this following setup:

Office Network:
192.168.9.x --> Subnet for all Wired Connections --> Wired Gateway IP  

192.168.10.x --> Subnet for all Wireless Connections --> Wireless Gateway IP

Raspberry Pi: --> Wired IP --> Gateway for Wired Network
172.16.x.x --> VPN Connection

WORKING: TestMachine 1: --> Wired IP --> Assigned Gateway IP (IP of RPi)
VPN tunneling works here
Websites that are only accessible via VPN is accessible
Can Ping any wired and wireless IP machines
Can browse internet

NOT-WORKING: TestMachine 2: --> Wireless IP --> Assigned Gateway IP (IP of RPi)
VPN tunneling not working
Websites that are only accessible via VPN is not accessible
Can Ping any wired and wireless IP machines
Can browse internet

I was hoping that VPN in the Test Machine 2 will also work but I was wondering why it is failing. What I basically expecting is that both our wired and wireless connections should be able to use the VPN Router (RPi) and tunnel all connections to it.

Any idea what am I missing here? Do I need to make some routes to be applied in RPi machine to let all wireless based subnets go correctly in vpn (tun0)? But I dont know the config on this either

1 Answer 1


in short:
set static route in internet router to VPN router (RasPi)
set default gateway on Testmachine 2 to internet router
optional: set default gateway on Testmachine 1 to internet router

Very good explained question. It is a pure routing problem and seems not to be a big problem (if you can configure the wifi/internet router). You have three subnets, and Routing (TestMachine 1) to works because it is on the same subnet than the VPN router (RasPi).

The RasPi router to is on subnet as already told so all packages to must go to its router also that one from (TestMachine 2). Here comes the second router to play, that one that routes between and I suppose it is your internet router which has ethernet ports and established the wifi. You must tell it to send packages belonging to to the next hop on one of its subnets. That is the RasPi router It knows where to go on. You do it with a static route.

On most internet router you can set a static route but how to do that varies from model to model. It's up to you to find it out. The next hop is (the RasPi router), destination network is (or netmask

TestMachine 2 must send all its packages to the internet router because that decides where they have to go: to the internet or to the VPN tunnel. Set the default gateway on TestMachine 2 to

You have set the default gateway on Testmachine 1 to the RasPi That is OK because the RasiPi routes all internet traffic to its default gateway (internet router). But I would set the default route on Testmachine 1 to (internet router). That is a better, symmetric network setup and may have a performance boost when most traffic goes to the internet. The RasPi is limited with its ethernet port.

  • It seems that it is an easy fix if only I have access to our WiFi/Internet router and/or Network for this matter but the reality is there's no chance that I can request such a change on a network level. The only viable option that doesn't require me to knock on IT Department's door is to have an extra RPi to cater clients that connects thru Wireless connection. This also means that RPi needs to be configured in wlan0 and not on eth0.
    – JVS
    Commented Sep 18, 2018 at 5:32
  • @JVS I mean you don't need a second RasPi. The one you have may be able to do all things. Is it possible that TestMachine 2 (and all other hosts on wifi) connect to a RasPis wifi instead of the wifi from the internet router?
    – Ingo
    Commented Sep 18, 2018 at 8:28
  • @JVS Is it possible that the RasPi also connect to the internet routers wifi (192.168.10/24) as client? And can you give it a static ip address on the wifi interface?
    – Ingo
    Commented Sep 18, 2018 at 8:34
  • if that's the case, of having the RPi eth0 and wlan0 interfaces both have configured IP addresses, it will not satisfy my initial question though this setup will work but this is not what I assume to accomplish though
    – JVS
    Commented Sep 20, 2018 at 23:27
  • @JVS As far as I understand your question is how Testmachine 2 can get through the VPN tunnel and can go into the internet without modifying the internet router. For this you need a connection between Testmachine 2 and the RasPi in any way without using the internet router.
    – Ingo
    Commented Sep 21, 2018 at 8:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.