1

I have an OpenVPN set up that looks like this:

                                            +------------------------------------------------------+
                                            |                                                      |
                                            |                                                      |
                                            |                                                      |
                                            |                                                      |
                                            |                                                      |
                                            |                                                      |
                                            |                                                      |
                                            |                 +-------------+--+                   |
                                            |                 | Internal Server|                   |
                                            |                 | 10.19.4.35     |                   |
                                            |                 |                |                   |
                                            |                 +----------------+                   |
                                      +-----+-------+                                              |
                                      | Gateway     |                                              |
                                      | 10.19.4.1   |                                              |
                                      |             |                                              |
                                      +-----+-------+         +--------+-------+                   |
                                            |                 | VPN Server     |                   |
                                            |                 | 10.19.4.59 eth0|                   |
                               +------------------------------+ 10.19.5.0 tun0 |                   |
+-------------+---+            |            |                 +----------------+                   |
|   Remote Server |            |            |                                                      |
|   10.0.0.2 eth0 +------------+            |                                                      |
|   10.19.5.2 tun0|                         |                                                      |
+-----------------+                         |                                                      |
                                            |                                                      |
                                            |                                                      |
                                            +------------------------------------------------------+
                                                              VPC                                   

The Gateway is an AWS Gateway and there's a route to forward 10.19.5.0/24 traffic to the VPN server. I'm also pushing a route to Remote Server for 10.19.4.0/24. I'm also using NAT on eth0 on the VPN server.

If I ping "Internal Server" from "Remote Server" it works perfectly and I receive a response. If I ping VPN Server's eth0 IP from Internal Server, I receive a response correctly.

The issue is that if I try to ping Remote Server or VPN Server's tun0 IP address from Internal Server, it never gets the response. After doing some TCP dumps, I've discovered that when I try to send packets out to 10.19.5.0/24 from Internal server it goes to the gateway like you would expect. The gateway then routes this traffic to the VPN server. The VPN Server is handling the traffic correctly in that it will generate a response if it's the target, or route the packet to the remote server and it's response if the remote server is the target.

The issue is that rather than sending that response to the gateway, the VPN server just sends the packet directly to 'Internal Server' (this has been confirmed by observing MAC addresses with tcpdump).

I've seen some documentation about how to fix this, but after playing around with SNAT/DNAT/MASQUERADE and specifying various source address, I'm still not sure how to fix it with IPTABLES.

Any help would be greatly appreciated.

2

It turns out that this was an Amazon issue. I had to disable src/destination checking from the panel to allow it to route packets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.