0

I've been trying for a few hours to get OpenVPN working with AWS EC2 without any luck. Its the same setup as anyone would think of: Openvpn running on a server to gain access to resources within the VPC (private address space).

I've turned off "check source / dest" address on ALL instances, without luck.

VPN: 10.9.0.0/16 VPC: 172.16.0.0/16

I can connect to the VPN fine and ping 10.9.0.x fine. Can also ping the private address on the same box as the VPN. The two boxes can ping each other (private or public) just fine.

The problem's with AWS. Can I do NAT on this somehow so it thinks the packet is originating from the private address space?

[root - openvpn]# tcpdump -i any -n icmp
01:15:00.571096 IP 10.9.0.6 > 172.31.88.99: ICMP echo request, id 56638, seq 16, length 64
01:15:00.571125 IP 10.9.0.1 > 10.9.0.6: ICMP host 172.31.88.99 unreachable - admin prohibited, length 92
3

There are a few steps you need to do.

On the openvpn server you have to make sure ip forwarding is on

echo 1 > /proc/sys/net/ipv4/ip_forward

You shouldn't need any fancy NAT or MASQ rules for openvpn if you want the destination host to see the VPN IP (which you should in my opinion)

On the AWS side you need to make sure your route tables are setup to route the VPN CIDR (10.9.0.0/16) back to the openvpn server.

| improve this answer | |
  • My hero! echo 1 > /proc/sys/net/ipv4/ip_forward was enabled already (forgot to add that). It was the missing route. Thanks Mike. – Kevin Parker Mar 30 '16 at 5:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.