Currently trying to connect to an openVPN server set up on an EC2 instance that is also running a web application. My client establishes a connection with the server and I can ping the gateway ( from the client but my routing isn't working. Here's the output from the OVPN server log immediately after connection:

MULTI: bad source address from client [client IP], packet dropped

I have ip forwarding set in sysctl, and I have the following iptables rules:

:OUTPUT ACCEPT [135:8311]
-A POSTROUTING -s [client IP]/24 -o tun0 -j MASQUERADE
# Completed on Mon Apr 25 17:01:46 2016
# Generated by iptables-save v1.4.21 on Mon Apr 25 17:01:46 2016
:INPUT ACCEPT [16905:2067971]
:OUTPUT ACCEPT [16818:2063714]
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o tun+ -j ACCEPT

My server config:

port 1194
proto udp
dev tun
ifconfig-pool-persist ipp.txt
push "route"
push "redirect-gateway def1 bypass-dhcp
push "dhcp-option DNS"
push "dhcp-option DNS

My EC2 instance is on the subnet, and has a public ip of 54.88.7.x.

Really not sure where to go from here, so any insight would be greatly appreciated.

  • did you use the client config directory? /etc/openvpn/ccd/ - create a file in here for you client and add the route "iroute – Sum1sAdmin Apr 26 '16 at 16:18
  • ..also add the path to the client config directory in your server config "client-config-dir ccd" – Sum1sAdmin Apr 26 '16 at 16:19
  • I haven't done that, no -- but wouldn't the push "route" line in my server config do the same thing?? – tparrott Apr 26 '16 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.