Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Software developer here, trying to get his sysadmin-foo up and running by setting up an OpenVPN server on amazon EC2 to access all the internal resources there. Here's how I envision that on a fresh Ubuntu 12.04 Canonical AMI:

   Local network          /        EC2 Cloud, 10.*.*.*/255.0.0.0
  172.16.20.*/          ,'
     255.255.255.0     ,'                +-----------------+
                      .'                 |Amazon DNS server|
                      |                ,'|  172.16.0.23    |
 +---------------+   |               ,'  +-----------------+
 | Workstation   |   |             ,'
 |               XXX |   +-------,'------+
 | 172.16.20.1   |  XXXX | OpenVPN server|
 +------`.-------+   \  XX  10.23.45.67  `-.  +-------------+
          \          '.  +---------------+  `-. Second server
  +--------`.---+     |                       | 10.23.45.68 |
  |Local server |      \                      +-------------+
  | 172.16.20.2 |       \
  +-------------+        \

Clients can connect to the VPN (even on iPhone), but I'm having trouble to get a full overview of which subsystems i need to check.

Here are my goals for the setup:

  • VPN clients should be able to access internal resources via the vpn, the rest of the internet should be routed via the local gateway
  • VPN clients should be able to access all servers the OpenVPN server can access
  • VPN clients should use the Amazon DNS server at 172.16.0.23 as their primary dns server, because that server resolves Amazon's generated hostnames to internal ip addresses (i.e. ec2-45-67-8-9.eu-west-1.compute.amazonaws.com would resolve to 10.23.45.67 when resolved by that server, but to 45.67.8.9 everywhere else)
  • VPN clients should see each other

Here's how I configured /etc/openvpn/server.conf (just the interesting bits, i hope):

persist-tun
server 172.16.10.0 255.255.255.0
push "route-gateway 172.16.10.1"
push "route 10.0.0.0 255.0.0.0"

push "route 172.16.0.23"
push "dhcp-option DNS 172.16.0.23"

However, I'm not sure which parts of these the openvpn server does for me:

  • Do I need to configure iptables on the server ? If so, how ?
  • Do I need to set routes on the server (besides the ones being pushed to the client) ? If so, which and how ?
  • What other networking software am I missing that causes my clients not to connect successfully ?
share|improve this question
    
Can you set verb 5 on a client and add in the connection logs to your original post, along with the route print or route -n output of the client when it's connected? –  SmallClanger Apr 25 '13 at 12:45
    
Are the VPN clients located in your local network (172.16.20.0/24)? Do they access the OpenVPN server via their local gateway (172.16.20.1) or do they connect to the server's public IP? If they are not in your local network: Shall they have access to the local network or just to the systems at Amazon? –  Hauke Laging Apr 27 '13 at 20:15

1 Answer 1

up vote 2 down vote accepted

You need to enable forwarding on the OpenVPN server in the kernel (/proc/sys/net/ipv4/ip_forward) and you have to globally or selectively allow forwarding in the firewall (iptables), e.g.:

# there is probably already a rule allowing all established connections
# iptables -A FORWARD -m conntrack --ctstate ESTABLISHED -j ACCEPT
# the next rules for every OpenVPN interface (or once for the respective address block)
iptables -A FORWARD -i tun0 -d 10.0.0.0/8  -j ACCEPT
iptables -A FORWARD -i tun0 -d 172.16.0.23 -j ACCEPT
# if the local network shall be accessible
# iptables -A FORWARD -i tun0 -d 172.16.20.0/24 -j ACCEPT

You need not set routes on the server if just simple clients connect. If 172.16.20.1 connects as a gateway for the local network then you need a route for 172.16.20.0/24 but that is probably (and best) set in the OpenVPN config for 172.16.20.1.

Edit 1

If you cannot configure the routing on certain systems and their routing would not send the traffic back the right way then you need NAT (more precise: SNAT):

iptables -t nat -A POSTROUTING -d $PROBLEM_HOST_IP \! -s $LOCAL_IP \
  -j SNAT --to-source $LOCAL_IP

with the variables set accordingly. Assuming you can set the correct routing for targets in 172.16.20.0/24 only then you can do this easier this way:

iptables -t nat -I POSTROUTING 1 -s $LOCAL_IP -j ACCEPT
iptables -t nat -I POSTROUTING 2 -d 172.16.20.0/24 -j ACCEPT
iptables -t nat -I POSTROUTING 3 -j SNAT --to-source $LOCAL_IP
share|improve this answer
    
Hauke: Your anwswer is fine for the one node you're connecting to. The question is how to expose the rest of the nodes in the non-VPC EC2 cluster. Those don't have a TUN devices and they don't have routes to the OpenVPN server. –  nirvdrum May 3 '13 at 14:23
    
@nirvdrum See edit –  Hauke Laging May 3 '13 at 15:09
    
@nirvdrum yes, that's the point of the question. I've configured everything with SNAT now, but having routes back to the OpenVPN server on all other nodes is even better ;) –  peritus May 6 '13 at 11:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.