1

We are a small software development company and have Amazon EC2 Windows instances set up as workstations that developers can remote desktop into and work on source code.

We have a client network (behind a PPTP VPN server) that we need to access frequently to deploy software and support existing systems. We are only allowed to connect to the VPN once per username and creating a new username for each developer is not an option. Using an IPSec firewall and then using a VPC Gateway is not an option. BOTTOM LINE: I'd like to share a single PPTP VPN connection with all my developer workstation instances.

Initially I had considered setting up a very powerful single Windows instance (effectively combining all developer workstations into one) and configuring a Windows PPTP connection that could be shared by all users on the instance. Unfortunately, we bumped into issues, the most annoying of which is that the instance becomes unreachable when the VPN connection is dropped. This is a known issue and I've tried the suggestions on a few threads on the Amazon support forum and have had to luck. The issue causes all users on the machine to lose their work because the instance has to be rebooted. Besides, the point of having developers on their own instances is to silo any issues to only affecting one user.

So, I decided to attempt setting up a small EC2 linux instance to act as a router/gateway for the PPTP VPN connection. I can get the linux box connected to the PPTP server with no issues... I can get traffic across the connection and it looks great. I followed steps 1 - 4 from: http://pptpclient.sourceforge.net/howto-debian.phtml#configure_by_hand and can bring up the connection easily with "pppd call ClientVPN" (I named the connection ClientVPN).

The last step is to get my other instances (Windows developer workstations) so that they can get to hosts on the client network by using the small linux router/gateway. I have followed a few different guides I found on the internet but I can't get it to work. The basic changes I made are like what's described here: http://www.sharms.org/blog/2008/11/how-to-share-a-vpn-connection-in-ubuntu-intrepid-ibex/

Can anyone help me out here... I feel like it should be working. I have EC2 security groups configured that allow all traffic between my instances. Client instances can ping the linux gateway and vice versa. I have the server connected to the VPN, the iptables changes made, ip forwarding enabled, and the client instances have a route defined that points to the linux instance for the ip range of the client... not sure what else I am missing...

Here's my situation:

EC2 network (dev instances and linux gateway): 10.x.x.x
Client Network: 192.168.20.x
Client VPN Network: 192.168.10.x

(Windows Instances) ==> (Linux Gateway Instance) ==> (INTERNET) ==> (Client Network)


My Machines:

vpn-gateway:

  • eth0 - 10.0.0.1
  • ppp0 - 192.168.10.101 (after connection is made)

win-dev-A: 10.0.0.2

win-dev-B: 10.0.0.3

... etc.

Client Machines:

client-vpn-server:

  • external: internet ip

  • internal: 192.168.10.100

client machines (that we need to get to):

  • 192.168.20.x

I've tried tracert from a dev instance and it ends up timing out after a few hops (and does not show my linux-gateway in the list of servers it goes through)

Any help would be greatly appreciated... I've beat my head against this for a few days now and I have run out of ideas.

Thanks,

Chris

3
  • You had better ask your question on Server Fault or security.stackexchange.com Jul 3, 2011 at 23:55
  • Can your users simply use ssh -L <localport>:<remotehostname>:<remoteport> port forwarding? It's a little cheap, but if there are only a handful of services inside the client network, it works well. (I wouldn't consider it a replacement for a real VPN, but if you can't deploy a real VPN, maybe a cheap hack can do the trick.)
    – sarnold
    Jul 3, 2011 at 23:57
  • We have a dozen or more servers on the client site that we need to access and usually a few services each (RDP, SQL, file sharing, etc.) so I don't think the port forwarding would be practical, although that sounds like a great tip for smaller needs... hadn't seen that before.
    – Chris
    Jul 4, 2011 at 0:41

1 Answer 1

1

If you've got routing on the linux box setup then it should just be a matter of adding a route to the desktop mahines so that any traffic to the 192.168.0.0 network routes through the linux box.

route add 192.168.0.0 mask 255.255.255.0 10.0.0.1 metric 3 if 1

You may need to modify the metric and and interface (if parameter).

You must log in to answer this question.