0

I've been trying for a few hours to get OpenVPN working with AWS EC2 without any luck. Its the same setup as anyone would think of: Openvpn running on a server to gain access to resources within the VPC (private address space).

I've turned off "check source / dest" address on ALL instances, without luck.

VPN: 10.9.0.0/16 VPC: 172.16.0.0/16

I can connect to the VPN fine and ping 10.9.0.x fine. Can also ping the private address on the same box as the VPN. The two boxes can ping each other (private or public) just fine.

The problem's with AWS. Can I do NAT on this somehow so it thinks the packet is originating from the private address space?

[root - openvpn]# tcpdump -i any -n icmp
01:15:00.571096 IP 10.9.0.6 > 172.31.88.99: ICMP echo request, id 56638, seq 16, length 64
01:15:00.571125 IP 10.9.0.1 > 10.9.0.6: ICMP host 172.31.88.99 unreachable - admin prohibited, length 92

1 Answer 1

3

There are a few steps you need to do.

On the openvpn server you have to make sure ip forwarding is on

echo 1 > /proc/sys/net/ipv4/ip_forward

You shouldn't need any fancy NAT or MASQ rules for openvpn if you want the destination host to see the VPN IP (which you should in my opinion)

On the AWS side you need to make sure your route tables are setup to route the VPN CIDR (10.9.0.0/16) back to the openvpn server.

1
  • My hero! echo 1 > /proc/sys/net/ipv4/ip_forward was enabled already (forgot to add that). It was the missing route. Thanks Mike. Mar 30, 2016 at 5:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .