I've managed to setup PiVPN on a Raspberry Pi 3+ and I can connect from the outside, I even have Internet access, but I don't have access to the local network.

These VLANs are created under my USG networks. Corporate network so they can communicate between each other.


  • Raspberry Pi @


  • Laptop @


  • OpenVPN @

This is the physical setup. I'm using br0 because Im boardcasting a Wifi SSID from the Raspberry Pi on wlan0.

                 vpn tunnel                         ┌──────────┐
       ╔═══════════════════════════════════════════════════════════ vpn client
RPi(br0)  <---------------->  USG   <-------------> │ INTERNET │
         \     wired        /                       │          │                   └──────────┘
               wifi       /         
      PC <~.~.~.~.~.~.~->/

I've created VLAN100 on my USG on and assign this IP range to openVPN

dev tun
proto udp
port 1194
topology subnet
# Route gateway
push "route-gateway"
# Set your primary domain name server address for clients
push "dhcp-option DNS"
# Routes
push "route"

ifconfig on RPi

br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet  netmask  broadcast
    inet6 fe80::93db:ce25:c561:7628  prefixlen 64  scopeid 0x20<link>
    ether b8:27:eb:36:86:95  txqueuelen 1000  (Ethernet)
    RX packets 275827  bytes 43249972 (41.2 MiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 529402  bytes 61574005 (58.7 MiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        ether b8:27:eb:63:d3:c0  txqueuelen 1000  (Ethernet)
        RX packets 1922462  bytes 869206353 (828.9 MiB)
        RX errors 0  dropped 13625  overruns 0  frame 0
        TX packets 2520062  bytes 307984351 (293.7 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

        inet  netmask  destination
        inet6 fe80::8dc9:82fe:66ca:71fd  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        ether b8:27:eb:36:86:95  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 187646  bytes 22435353 (21.3 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

iptables -S

-N f2b-sshd
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A f2b-sshd -j RETURN

iptables -t NAT -S


ip route

default via dev br0 src metric 203 
default via dev eth0.10 src metric 208 
default via dev eth0.20 src metric 209 dev br0 proto kernel scope link src metric 203 dev eth0.10 proto kernel scope link src metric 208 dev eth0.20 proto kernel scope link src metric 209 dev tun0 proto kernel scope link src 
  • You mention three VLANs, What exactly is the local network that you want to access?
    – RalfFriedl
    May 31, 2019 at 19:53
  • VLAN30 (
    – jtomasrl
    May 31, 2019 at 20:10
  • That network is not so local to the PI. Did you create a route to that network?
    – RalfFriedl
    May 31, 2019 at 20:34
  • you mean on the RPI? if so, no I havent. Im not really sure how to
    – jtomasrl
    May 31, 2019 at 20:52
  • Can you add the routing table (output of ip route to the question? Do you want to access from the PI or from the external VPN client?
    – RalfFriedl
    May 31, 2019 at 21:05

1 Answer 1


It seems you are missing a route somewhere.

If you want to reach from an external VPN client, you need the correct routing entries on every step along the way, and on the way back. I assume that is reachable from the PI, so the way to should be covered.

But what about the route back? has only one connection, that to the USG, so there should already be a default route to the USG. But what about the USG, does it know to send traffic for (the addresses of the VPN clients) to the PI?

In general, if you have routing problems, you can run a ping and use tcpdump so see the ICMP requests and responses. Watch the packets on each gateway and verify that they are directed to the proper destination, until you reach a router where the packets don't arrive or where they are sent to the wrong destination, then fix the routing tables so that they go to the correct destination.

You already push a route to to the client, this is correct but should be not necessary, as it is covered by the default route (route-gateway).

to your network. This network is not local to the PI in the sense that it is directly reachable. Instead it is reachable through the USB.

The problem is that as soon as the VPN goes up,

  • Ok got it working, I changed back to OpenVPN IP range (, added the correct iptables entry (-A POSTROUTING -s -o br0 -j MASQUERADE) and it's working. Now, one thing I cant make it work, is to connect to the local RPI services running there on dockers
    – jtomasrl
    Jun 1, 2019 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.