0

I am trying to set up a lab where I can run metasploitable against vulnerable VMs on AWS running in a private subnet, accessible through an OpenVPN server I have set up. I can connect to the OpenVPN server and I can successfully ssh to the VMs on the private subnet, but running the exploit requires the VM to be able to initiate a connection back to the attack machine -- so the machines on the private subnet need a route to the connected VPN client. The private instances do not have internet access.

I had an idea that I could make each of the instances on the private subnet clients on the VPN network, also, and set it so that clients can talk to one another. This works as long as the VMs have an internet connection. I also got it to work on AWS when using a NAT Gateway in front of the private vms (giving them internet access, and the ability to connect to the public IP of the openvpn server), but I lose the ability to connect to the private VMs with their amazon-allocated private IP when they are connected to the VPN. So I can't manage the instances individually without nmapping the network to find out what's live. I'd rather still have access to them via their private IPs.

I tried the "make them clients" idea without using a NAT gateway by changing the client.conf to connect to the private IP of the OpenVPN server, but I lose connectivity to the private vulnerable VMs when I do that. I suspect I lose access because a route is being pushed to the private instances rerouting all local subnet traffic to the VPN, and there's already a route for the local traffic, but I didn't have connection when I used the route-nopull config option either (If this is on the right track but not quite right, I'm not sure what to manually do to the route table when I do this to make up for the lack of the route push for the VPN network).

Is there a better way to go about giving the private instances access to the connected VPN clients?

Edit: the private instances are running openvpn v2.3.2, so selective route rejection isn't available to me :(

Edit 2: route-nopull combined with route 10.8.0.0 255.255.255.0 [the network that openvn serves on] in client.conf on the private network vms seems to be working. Also works on my VPC where the private instances don't have a NAT gateway (where I point the openvpn config at the private ip of my openvpn server). I'm still interested in knowing if there's a better way of doing all this though.

0

route-nopull combined with route 10.8.0.0 255.255.255.0 [the network that openvn serves on] in client.conf on the private network vms seems to be working. Also works on my VPC where the private instances don't have a NAT gateway (where I point the openvpn config at the private ip of my openvpn server).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.