I've had VPN setup on my OS X Server forever, but I've only used it for remote access to manage the server itself, never as a pass through to the internet at large. It occurred to me that when I travel it might be useful to have my communications routed through my server, so I've tried setting it up to do so and I'm not able to get it to work.

  • I've switched on "route all communications through VPN" in the client settings.

  • I don't have any routes defined in the VPN settings of Server.

  • My server acts as a DNS server already so my VPN settings point to it as the first DNS server.

  • I have a public DNS server listed as the second.

When I connect to the VPN and try to get to a web page, no luck-- Safari just times out.

I can "host google.com" successfully from the terminal and if I use an IP address in the Safari location bar, I still can't connect. So I don't think the problem is DNS.

I can get to the web when logged in locally to the server, so I think the port is open.

I had experimented with IceFloor a few years ago, but have since removed it-- I'm not entirely sure where to look for remnants of it but I don't see any files for it floating around and I don't see pf in the process list.

Any other ideas?


I think we could use some more detail about your VPN, I'm guessing it's openvpn?

From memory you should allow 'route all comms' in the server settings and create a default route from your vpn-client subnet to the server's gateway or exit nic. You'll also want to make sure firewall settings allow traffic between the IPs & ports you want.

Finally, check what can ping what else to determine the point of the problem. Check if your client can ping the server's internal VPN IP address, its external interface while traffic is routed through the VPN, then its default gateway. If that doesn't highlight the problem and you can ping the external gateway while traffic is routed through the vpn (use traceroute to confirm the path) check if the server can actually reach the external hosts you're attempting to connect to.

  • 1
    The VPN is the one provided by Server.app, I'm not sure what it is under the hood. I have ticked "route all comms" in the client. I don't see a corresponding switch for the server. I have no routes defined for the VPN which the help file suggests means all traffic is routed through the VPN. Disabling the SysPrefs firewall doesn't affect the outcome. I can reach destinations on the Server's network, but can neither ping nor reach sites outside the local network. DNS seems to work for the client (Server provides DNS). – Omegaman Jun 10 '18 at 8:11
  • 1
    You may have routing from client setup to pass all traffic over the VPN, but unless the server also knows that it should route traffic from the VPN Client IP address out through its default gateway you won't be able to ping the internet via the VPN. You can check the routing tables on the server to confirm that the IP address & Subnet that the VPN clients are assigned to is routed out the default gateway or NIC. – Scottmeup Jun 10 '18 at 8:31
  • 1
    Possibly you may have more luck with responses to this question on server fault, it's more networking focused. – Scottmeup Jun 10 '18 at 9:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .