Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Software developer here, trying to get his sysadmin-foo up and running by setting up an OpenVPN server on amazon EC2 to access all the internal resources there. Here's how I envision that on a fresh Ubuntu 12.04 Canonical AMI:

   Local network          /        EC2 Cloud, 10.*.*.*/
  172.16.20.*/          ,'     ,'                +-----------------+
                      .'                 |Amazon DNS server|
                      |                ,'|    |
 +---------------+   |               ,'  +-----------------+
 | Workstation   |   |             ,'
 |               XXX |   +-------,'------+
 |   |  XXXX | OpenVPN server|
 +------`.-------+   \  XX  `-.  +-------------+
          \          '.  +---------------+  `-. Second server
  +--------`.---+     |                       | |
  |Local server |      \                      +-------------+
  | |       \
  +-------------+        \

Clients can connect to the VPN (even on iPhone), but I'm having trouble to get a full overview of which subsystems i need to check.

Here are my goals for the setup:

  • VPN clients should be able to access internal resources via the vpn, the rest of the internet should be routed via the local gateway
  • VPN clients should be able to access all servers the OpenVPN server can access
  • VPN clients should use the Amazon DNS server at as their primary dns server, because that server resolves Amazon's generated hostnames to internal ip addresses (i.e. would resolve to when resolved by that server, but to everywhere else)
  • VPN clients should see each other

Here's how I configured /etc/openvpn/server.conf (just the interesting bits, i hope):

push "route-gateway"
push "route"

push "route"
push "dhcp-option DNS"

However, I'm not sure which parts of these the openvpn server does for me:

  • Do I need to configure iptables on the server ? If so, how ?
  • Do I need to set routes on the server (besides the ones being pushed to the client) ? If so, which and how ?
  • What other networking software am I missing that causes my clients not to connect successfully ?
share|improve this question
Can you set verb 5 on a client and add in the connection logs to your original post, along with the route print or route -n output of the client when it's connected? – SmallClanger Apr 25 '13 at 12:45
Are the VPN clients located in your local network ( Do they access the OpenVPN server via their local gateway ( or do they connect to the server's public IP? If they are not in your local network: Shall they have access to the local network or just to the systems at Amazon? – Hauke Laging Apr 27 '13 at 20:15
up vote 3 down vote accepted

You need to enable forwarding on the OpenVPN server in the kernel (/proc/sys/net/ipv4/ip_forward) and you have to globally or selectively allow forwarding in the firewall (iptables), e.g.:

# there is probably already a rule allowing all established connections
# iptables -A FORWARD -m conntrack --ctstate ESTABLISHED -j ACCEPT
# the next rules for every OpenVPN interface (or once for the respective address block)
iptables -A FORWARD -i tun0 -d  -j ACCEPT
iptables -A FORWARD -i tun0 -d -j ACCEPT
# if the local network shall be accessible
# iptables -A FORWARD -i tun0 -d -j ACCEPT

You need not set routes on the server if just simple clients connect. If connects as a gateway for the local network then you need a route for but that is probably (and best) set in the OpenVPN config for

Edit 1

If you cannot configure the routing on certain systems and their routing would not send the traffic back the right way then you need NAT (more precise: SNAT):

iptables -t nat -A POSTROUTING -d $PROBLEM_HOST_IP \! -s $LOCAL_IP \
  -j SNAT --to-source $LOCAL_IP

with the variables set accordingly. Assuming you can set the correct routing for targets in only then you can do this easier this way:

iptables -t nat -I POSTROUTING 1 -s $LOCAL_IP -j ACCEPT
iptables -t nat -I POSTROUTING 2 -d -j ACCEPT
iptables -t nat -I POSTROUTING 3 -j SNAT --to-source $LOCAL_IP
share|improve this answer
Hauke: Your anwswer is fine for the one node you're connecting to. The question is how to expose the rest of the nodes in the non-VPC EC2 cluster. Those don't have a TUN devices and they don't have routes to the OpenVPN server. – nirvdrum May 3 '13 at 14:23
@nirvdrum See edit – Hauke Laging May 3 '13 at 15:09
@nirvdrum yes, that's the point of the question. I've configured everything with SNAT now, but having routes back to the OpenVPN server on all other nodes is even better ;) – peritus May 6 '13 at 11:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.