1

I've been trying my EC2 instance (OMD) to communicate to my LAN server (Raspberry Pi) via another EC2 instance (OpenVPN) but I can't make it work.

The OMD server can ping the RPi but it can't connect to it via SSH even though the SSH settings are default and there is no firewall. Port 6556 is accessible though.

Port scan from OMD server

[root@omd ~]# nc -zvv 192.168.16.150 6556
Connection to 192.168.16.150 6556 port [tcp/*] succeeded!
[root@omd ~]# nc -zvv 192.168.16.150 22
nc: connect to 192.168.16.150 port 22 (tcp) failed: Connection timed out
[root@omd ~]#

RPi's 22 and 6556 are open to all but why does the OMD can't SSH to it?

root@rpi:~# netstat -tunlp | egrep "6556|22"
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      535/sshd
tcp        0      0 0.0.0.0:6556            0.0.0.0:*               LISTEN      743/xinetd
tcp6       0      0 :::22                   :::*                    LISTEN      535/sshd
root@rpi:~#

Here's what I've been trying to achieve. Please see this link.

  1. OpenVPN and RPi are connected with each other via VPN connection
  2. OMD will not connect to VPN, it will just use the OpenVPN server as a gateway
  3. OMD will communicate with RPi through OpenVPN server and vice versa

Could you please help me with this?

Please let me know if you need more information.

Thanks in advance guys!

AWS - OMD
eth0: 10.0.0.4

=======================
PING
=======================
[root@omd ~]# ping -c 3 192.168.16.150
PING 192.168.16.150 (192.168.16.150) 56(84) bytes of data.
64 bytes from 192.168.16.150: icmp_seq=1 ttl=63 time=100 ms
64 bytes from 192.168.16.150: icmp_seq=2 ttl=63 time=100 ms
64 bytes from 192.168.16.150: icmp_seq=3 ttl=63 time=159 ms    

--- 192.168.16.150 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2159ms
rtt min/avg/max/mdev = 100.072/119.877/159.357/27.917 ms
[root@omd ~]#    
=======================
TRACEROUTE
=======================
[root@omd ~]# traceroute 192.168.16.150
traceroute to 192.168.16.150 (192.168.16.150), 30 hops max, 60 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *
[root@omd ~]#    
=======================
ROUTE TABLE
=======================
[root@omd ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.0.0        0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.16.0    10.0.0.5        255.255.255.0   UG    0      0        0 eth0
172.17.0.0      10.0.0.5        255.255.255.0   UG    0      0        0 eth0
0.0.0.0         10.0.0.1        0.0.0.0         UG    0      0        0 eth0
[root@omd ~]#

AWS - OpenVPN
eth0: 10.0.0.5
tun0: 172.17.0.1

=======================
PING
=======================
[root@openpvn ~]# ping -c 3 10.0.0.4
PING 10.0.0.4 (10.0.0.4) 56(84) bytes of data.
64 bytes from 10.0.0.4: icmp_seq=1 ttl=64 time=0.502 ms
64 bytes from 10.0.0.4: icmp_seq=2 ttl=64 time=0.639 ms
64 bytes from 10.0.0.4: icmp_seq=3 ttl=64 time=0.570 ms

--- 10.0.0.4 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 0.502/0.570/0.639/0.059 ms
[root@openpvn ccd]# ping -c 3 192.168.16.150
PING 192.168.16.150 (192.168.16.150) 56(84) bytes of data.
64 bytes from 192.168.16.150: icmp_seq=1 ttl=64 time=173 ms
64 bytes from 192.168.16.150: icmp_seq=2 ttl=64 time=142 ms
64 bytes from 192.168.16.150: icmp_seq=3 ttl=64 time=120 ms

--- 192.168.16.150 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 120.684/145.486/173.209/21.546 ms
[root@openpvn ~]#
=======================
ROUTE
=======================
[root@openvpn ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.0.1        0.0.0.0         UG    0      0        0 eth0
10.0.0.0        0.0.0.0         255.255.255.0   U     0      0        0 eth0
169.254.169.254 0.0.0.0         255.255.255.255 UH    0      0        0 eth0
172.17.0.0      0.0.0.0         255.255.255.0   U     0      0        0 tun0
192.168.16.0    172.17.0.2      255.255.255.0   UG    0      0        0 tun0
[root@openvpn ~]#
=======================
IPTABLES
=======================
[root@openvpn ~]# cat /etc/sysconfig/iptables
*nat
:POSTROUTING ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -s 172.17.0.0/24 -d 0.0.0.0/0 -o eth0 -j MASQUERADE
COMMIT
[root@openvpn ~]#
=======================
SYSCTL
=======================
[root@openvpn ~]# grep forward /etc/sysctl.conf
# Controls IP packet forwarding
net.ipv4.ip_forward = 1
[root@openvpn ~]#

LAN - Raspberry Pi
eth0: 192.168.16.150
tun0: 172.17.0.253

=======================
PING
=======================
root@rpi:~# ping -c 3 10.0.0.4
PING 10.0.0.4 (10.0.0.4) 56(84) bytes of data.
64 bytes from 10.0.0.4: icmp_seq=1 ttl=63 time=128 ms
64 bytes from 10.0.0.4: icmp_seq=2 ttl=63 time=106 ms
64 bytes from 10.0.0.4: icmp_seq=3 ttl=63 time=126 ms   

--- 10.0.0.4 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 106.837/120.409/128.312/9.644 ms
root@rpi:~# 
=======================
TRACEROUTE
=======================
root@rpi:~# traceroute 10.0.0.4
traceroute to 10.0.0.4 (10.0.0.4), 30 hops max, 60 byte packets
 1  172.17.0.1 (172.17.0.1)  177.150 ms  200.416 ms  199.949 ms
 2  10.0.0.4 (10.0.0.4)  205.052 ms  216.804 ms  223.456 ms
root@rpi:~# 
=======================
ROUTE TABLE
=======================
root@rpi:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.17.0.1      128.0.0.0       UG    0      0        0 tun0
0.0.0.0         192.168.8.1     0.0.0.0         UG    0      0        0 eth1
0.0.0.0         192.168.16.254  0.0.0.0         UG    202    0        0 eth0
0.0.0.0         192.168.8.1     0.0.0.0         UG    203    0        0 eth1
5X.XX.XX.XXX    192.168.8.1     255.255.255.255 UGH   0      0        0 eth1
128.0.0.0       172.17.0.1      128.0.0.0       UG    0      0        0 tun0
172.17.0.0      0.0.0.0         255.255.255.0   U     0      0        0 tun0
192.168.8.0     0.0.0.0         255.255.255.0   U     203    0        0 eth1
192.168.16.0    0.0.0.0         255.255.255.0   U     202    0        0 eth0
root@rpi:~#
0
0

Given the diagram I see is specifies that you are using a tun adapter, meaning a routed network, and not a layer 2 vpn network. You need to have IP forwarding working properly. Plus for your situation you will also need to do some NAT on the VPN server due to the security involved in the ssh protocol to ensure that traffic goes back and forth via the same server hops.

There are a couple of pieces to having this working. All of the below is for a slightly old CentOS system.

Setup IP forwarding on any OpenVPN (client or server) machine that has a LAN attached.

  • vi /etc/sysconfig/network and add the line FORWARD_IPV4=true
  • vi /etc/sysctl.conf and change net.ipv4.ip_forward = 1

To set up the NAT required, if you are using iptables for your firewall these commands are needed on any OpenVPN (client or server) machine that has a LAN attached.

  • iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
  • iptables --table nat --append POSTROUTING --out-interface tun0 -j MASQUERADE

Disabling the firewall will break it. You can probably also use firewalld, but I don't have the commands needed for that handy. Also once satisfied with the iptables rules remember to save them, so they persist through a reboot.

Plus for each end of the VPN to know to route traffic for the LAN on the other end of the VPN to go over the tunnel the server needs

  • the config lines route remote_network subnet for each of the remote sites with a LAN attached so the local server knows to route traffic destined for those subnets over that tunnel.
  • the config lines push "route network subnet" so each of the connecting clients know to route traffic over the tunnel for those subnets. This will include the server LAN and all client LANs.
  • the config line client-config-dir ccd so the server knows to check the folder /etc/openvpn/ccd for files with names of clients with LANs in it
  • the ccd/client-name file with the content iroute network subnet so the VPN software knows that when that client connects, traffic for that subnet is to be sent to that client.

Having all of those lines is required or at least particularly useful when you have more than one client LAN connecting. When there is only a single client connecting to a single server it is much simpler. A single LAN-to-LAN is not much more so.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.