0

I have a functional VPN network on EC2, but I can't initiate traffic to the internet from the web server(s), although they can serve requests.

The AWS setup if the following:

  • 2 Elastic IPs (eiplb and eipvpn)
  • EC2 machine (myvpn), with public eipvpn address, private IP 10.1.2.16, acting as VPN server; Source/Destination Check is disabled
  • EC2 machine (myweb) without public IP, private 10.1.2.32, acting as web server
  • (Application) Load Balancer, with public eiplb address, sends requests to myweb
  • VPC (myvpc) 10.1.2.0/24
  • Subnet 10.1.2.0/25, associated to myvpc
  • Internet Gateway (myigw), attached to `myvpc)
  • Route table (10.1.2.0/24 -> local, 0.0.0.0/0 -> myigw)

The current outcome is:

  • the VPN server works; I can authenticate to it, then access myweb;
  • the load balancing/app serving works; I can send HTTP requests on eiplb, which are served by myweb
  • the myvpn machine can initiate connections to the internet

The problem is that myweb can't initiate connections to the internet.

For reference this is the iptables setup on myvpn:

# everything `ACCEPT`
-A POSTROUTING -s 10.2.3.0/24 ! -d 10.2.3.0/24 -j SNAT --to-source 10.1.2.16

This is the routing table on myweb:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.1.2.1        0.0.0.0         UG    0      0        0 eth0
10.1.2.0        *               255.255.255.128 U     0      0        0 eth0

What's the simplest way to allow myweb to initiate connections to the internet?

  • Nothing jumps out at me as obviously wrong. I can't comment on iptables, not familiar with it. What is the VPN server used for, and is anything routed to it? You'll want to trace where packets are going. VPC Flow Logs will let you do this. CloudCraft is a good free diagramming tool that would make this setup easier to explain. – Tim Jun 12 '17 at 19:29
  • It's been a bit of a mistery; I've also tried to add a NAT gateway, but couldn't connect as well. I ended up assigning public IPs (which I tried to avoid). – Marcus Jun 14 '17 at 20:17
  • A NAT gateway, or instance? If you added a NAT instance it'd be interesting to see if it could ping it, and then get out to the internet using it. If you added a nat gateway and it didn't work that points to routing IMHO. – Tim Jun 14 '17 at 20:51
  • Gateway, as I needed a managed (highly available) service, sorry! – Marcus Jun 15 '17 at 21:09

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.