# How inter-peer traffic works in multi-host + replication + inter-client routing setup

**URL:** <https://forum.pritunl.com/t/how-inter-peer-traffic-works-in-multi-host-replication-inter-client-routing-setup/3500>\
**Category:** Pritunl VPN\
**Tags:** pritunl\
**Created:** [August 14, 2025, 12:36pm UTC](https://forum.pritunl.com/t/how-inter-peer-traffic-works-in-multi-host-replication-inter-client-routing-setup/3500 "2025-08-14T12:36:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kkalugeroff](https://forum.pritunl.com/user_avatar/forum.pritunl.com/kkalugeroff/32/1298_2.png) [@kkalugeroff](https://forum.pritunl.com/u/kkalugeroff)\
**Post date:** [August 14, 2025, 12:36pm UTC](https://forum.pritunl.com/t/how-inter-peer-traffic-works-in-multi-host-replication-inter-client-routing-setup/3500/1 "2025-08-14T12:36:33Z")

</div>

Hello @zach ,

I’m trying to block the inter-peer(peers on same host) traffic using extra iptables rules on these chain levels - input,forward,output but without any luck.  
I was able to block cross-host traffic using FORWARD chain but didn’t have any luck when peers are connected to same host.  
Could you explain how this inter-peer traffic is happening when the configuration in question are in place?

Thank you!

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [August 15, 2025, 6:23am UTC](https://forum.pritunl.com/t/how-inter-peer-traffic-works-in-multi-host-replication-inter-client-routing-setup/3500/2 "2025-08-15T06:23:37Z")

</div>

I don’t believe it is possible to control that traffic. When the _Inter-Client Routing_ option is disabled in the server settings that removes the `client-to-client` option from the OpenVPN configuration. But the server virtual network is included in the pushed routes which is needed to support network configurations like replicated servers or non-NAT configuration. By including the virtual server network in the pushed routes it will always allow the client to client traffic.

---

<div class="post-metadata">

**Author:** ![kkalugeroff](https://forum.pritunl.com/user_avatar/forum.pritunl.com/kkalugeroff/32/1298_2.png) [@kkalugeroff](https://forum.pritunl.com/u/kkalugeroff)\
**Post date:** [August 15, 2025, 8:28am UTC](https://forum.pritunl.com/t/how-inter-peer-traffic-works-in-multi-host-replication-inter-client-routing-setup/3500/3 "2025-08-15T08:28:55Z")

</div>

Would it be possible to add a configuration option in future versions to force all traffic through the kernel networking stack? This would make standard Linux security tools work consistently regardless of peer location.