OpenVPN normally uses the private IP range of If I wanted to create a vpc of, How can I prevent the DNS (or is it the DHCP) server for assigning addresses out of OenVPN's range?

So far I can only see creating subnets around that range and only put instances in those subnets, not in the parent VPC range. (Which may not even be possible anyways)?

  • 1
    "So far I can only see creating subnets around that range and only put instances in those subnets, not in the parent VPC range." Given that instances have to be in a subnet, this seems like a reasonable solution. – ceejayoz Jul 22 '15 at 19:34
  • I have no experience with Amazon services. Is the addressing you've given specific to this service? Do you have full control over your OpenVPN installation, or is it Amazon managed? If former, you should probably go another way - routing or bridging. – sam_pan_mariusz Jul 22 '15 at 20:01
  • Yes, the range and base can be chosen. But eventually, given a large site, or accessing from lots of other networks around the world, or some mistake by a future employee, there could be collision. I'm trying to understand how my own site can avoid using that range, (or any range chosen). – Dennis Jul 22 '15 at 23:02

Amazon VPC's network infrastructure assumes that all of the address space in the supernet associated with the VPC will be inside the VPC, associated with instance interfaces. Your VPN, being on the "other side" of one instance, isn't "inside" the VPC.

As such, you can't provision your VPN to use any subnet within the VPC's address block, if you want your VPN to work, because the VPC route tables will not accept the static route that you'd need, in order for traffic bound for the VPN to be routable from any instance other than the one that hosts the VPN. The routes for all subnets within the VPC's supernet are only ever implicit; explicit routes aren't accepted if they conflict, and a route to a subnet in the VPC's address space always conflicts. includes so that will not work. If your VPC is, your VPN would need to be something else, non-overlapping, like Then you'd add a static route in the VPC route table, routing that subnet to the instance ID of the instance that functions as the VPN server.

So an inadvertent conflict is pretty much impossible, by the nature of the design of the VPC network infrastructure.

  • Sorry for late reply and acceptance. Went through some health issues and work has been intense. – Dennis Sep 20 '15 at 0:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.