I have a functional VPN network on EC2, but I can't initiate traffic to the internet from the web server(s), although they can serve requests.

The AWS setup if the following:

  • 2 Elastic IPs (eiplb and eipvpn)
  • EC2 machine (myvpn), with public eipvpn address, private IP, acting as VPN server; Source/Destination Check is disabled
  • EC2 machine (myweb) without public IP, private, acting as web server
  • (Application) Load Balancer, with public eiplb address, sends requests to myweb
  • VPC (myvpc)
  • Subnet, associated to myvpc
  • Internet Gateway (myigw), attached to `myvpc)
  • Route table ( -> local, -> myigw)

The current outcome is:

  • the VPN server works; I can authenticate to it, then access myweb;
  • the load balancing/app serving works; I can send HTTP requests on eiplb, which are served by myweb
  • the myvpn machine can initiate connections to the internet

The problem is that myweb can't initiate connections to the internet.

For reference this is the iptables setup on myvpn:

# everything `ACCEPT`
-A POSTROUTING -s ! -d -j SNAT --to-source

This is the routing table on myweb:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         UG    0      0        0 eth0        *      U     0      0        0 eth0

What's the simplest way to allow myweb to initiate connections to the internet?

  • Nothing jumps out at me as obviously wrong. I can't comment on iptables, not familiar with it. What is the VPN server used for, and is anything routed to it? You'll want to trace where packets are going. VPC Flow Logs will let you do this. CloudCraft is a good free diagramming tool that would make this setup easier to explain. – Tim Jun 12 '17 at 19:29
  • It's been a bit of a mistery; I've also tried to add a NAT gateway, but couldn't connect as well. I ended up assigning public IPs (which I tried to avoid). – Marcus Jun 14 '17 at 20:17
  • A NAT gateway, or instance? If you added a NAT instance it'd be interesting to see if it could ping it, and then get out to the internet using it. If you added a nat gateway and it didn't work that points to routing IMHO. – Tim Jun 14 '17 at 20:51
  • Gateway, as I needed a managed (highly available) service, sorry! – Marcus Jun 15 '17 at 21:09

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.