0

Currently trying to connect to an openVPN server set up on an EC2 instance that is also running a web application. My client establishes a connection with the server and I can ping the gateway (10.8.0.1) from the client but my routing isn't working. Here's the output from the OVPN server log immediately after connection:

MULTI: bad source address from client [client IP], packet dropped

I have ip forwarding set in sysctl, and I have the following iptables rules:

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [135:8311]
:POSTROUTING ACCEPT [135:8311]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s [client IP]/24 -o tun0 -j MASQUERADE
COMMIT
# Completed on Mon Apr 25 17:01:46 2016
# Generated by iptables-save v1.4.21 on Mon Apr 25 17:01:46 2016
*filter
:INPUT ACCEPT [16905:2067971]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [16818:2063714]
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o tun+ -j ACCEPT

My server config:

port 1194
proto udp
dev tun
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 172.31.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.22

My EC2 instance is on the 172.31.0.0 subnet, and has a public ip of 54.88.7.x.

Really not sure where to go from here, so any insight would be greatly appreciated.

  • did you use the client config directory? /etc/openvpn/ccd/ - create a file in here for you client and add the route "iroute 172.31.0.0 255.255.255.0 – Sum1sAdmin Apr 26 '16 at 16:18
  • ..also add the path to the client config directory in your server config "client-config-dir ccd" – Sum1sAdmin Apr 26 '16 at 16:19
  • I haven't done that, no -- but wouldn't the push "route 172.31.0.0 255.255.255.0" line in my server config do the same thing?? – tparrott Apr 26 '16 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.