I'm trying to build an OpenVPN gateway from my VPC -> into the office network. I've successfully set up a VPN client on one of my EC2 instances (let's name it "gateway") and now it has VPN virtual interface "tun0".
Now I want to route all office-related traffic (dst 172.20.0.0/16) from the rest of EC2 instances in the VPC to "gateway"'s network interface (10.0.0.100).
I've tried 2 different approaches:
- add a new rule into the related AWS Route Table: 172.20.0.0/16 -> eni-XXX (where eni-XXX is an id of "gateway"'s interface);
- update EC2's route table: route add -net 172.20.0.0 netmask 255.255.0.0 gw 10.0.0.100
Both variants seem to be failed because running "tcpdump -i eth0 'src port not 22 and dst port not 22'" on the gateway and curling/pinging internal office ips shows nothing :(
Does anyone have an idea about what's wrong? Or may be has a batter solution for my problem?
And the second question. Once I get my traffic on gateway's eth0, I plan to forward it into the VPN connection using the following IpTables commands:
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -A FORWARD -i eth0 -s 10.0.0.0/16 -o tun0 -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
Should I expect any problems here (except enabling ip forwarding)?