We are a small software development company and have Amazon EC2 Windows instances set up as workstations that developers can remote desktop into and work on source code.
We have a client network (behind a PPTP VPN server) that we need to access frequently to deploy software and support existing systems. We are only allowed to connect to the VPN once per username and creating a new username for each developer is not an option. Using an IPSec firewall and then using a VPC Gateway is not an option. BOTTOM LINE: I'd like to share a single PPTP VPN connection with all my developer workstation instances.
Initially I had considered setting up a very powerful single Windows instance (effectively combining all developer workstations into one) and configuring a Windows PPTP connection that could be shared by all users on the instance. Unfortunately, we bumped into issues, the most annoying of which is that the instance becomes unreachable when the VPN connection is dropped. This is a known issue and I've tried the suggestions on a few threads on the Amazon support forum and have had to luck. The issue causes all users on the machine to lose their work because the instance has to be rebooted. Besides, the point of having developers on their own instances is to silo any issues to only affecting one user.
So, I decided to attempt setting up a small EC2 linux instance to act as a router/gateway for the PPTP VPN connection. I can get the linux box connected to the PPTP server with no issues... I can get traffic across the connection and it looks great. I followed steps 1 - 4 from: http://pptpclient.sourceforge.net/howto-debian.phtml#configure_by_hand and can bring up the connection easily with "pppd call ClientVPN" (I named the connection ClientVPN).
The last step is to get my other instances (Windows developer workstations) so that they can get to hosts on the client network by using the small linux router/gateway. I have followed a few different guides I found on the internet but I can't get it to work. The basic changes I made are like what's described here: http://www.sharms.org/blog/2008/11/how-to-share-a-vpn-connection-in-ubuntu-intrepid-ibex/
Can anyone help me out here... I feel like it should be working. I have EC2 security groups configured that allow all traffic between my instances. Client instances can ping the linux gateway and vice versa. I have the server connected to the VPN, the iptables changes made, ip forwarding enabled, and the client instances have a route defined that points to the linux instance for the ip range of the client... not sure what else I am missing...
Here's my situation:
EC2 network (dev instances and linux gateway): 10.x.x.x
Client Network: 192.168.20.x
Client VPN Network: 192.168.10.x
(Windows Instances) ==> (Linux Gateway Instance) ==> (INTERNET) ==> (Client Network)
- eth0 - 10.0.0.1
- ppp0 - 192.168.10.101 (after connection is made)
external: internet ip
client machines (that we need to get to):
I've tried tracert from a dev instance and it ends up timing out after a few hops (and does not show my linux-gateway in the list of servers it goes through)
Any help would be greatly appreciated... I've beat my head against this for a few days now and I have run out of ideas.