I need to access some hosts that are accessible through OpenVPN from my AWS VPC private subnet. My VPC setup is similar to the one described here.

Inside the private network I've created an EC2 instance which sets up an OpenVPN client with the following command:

openvpn --verb 3 --config config.ovpn  --script-security 2 --up up.sh

Content of the up.sh script file:


/sbin/sysctl -w net.ipv4.ip_forward=1
/sbin/iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT 2>&1
/sbin/iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED \
-j ACCEPT 2>&1
/sbin/iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE 2>&1

Let's assume that is the subnet behind VPN. Route table for private subnet looks like this:

DESTINATION    TARGET    local      nat-gateway  ec2-instance-with-openvpn-client

I'm using default security groups.

My problem is that I cannot access hosts behind VPN from a docker image running in an ECS cluster inside private subnet. OpenVPN client is working properly because I can access hosts behind VPN directly from the EC2 instance. From what I was able to observe, I think that traffic from docker never reaches EC2 instance, but I'm not 100% sure about that.

  • You have not mentioned whether you disabled the source/destination check in your tunnel instance, though I assume you have, since that should be necessary before you can configure VPC route tables to use an instance as a route table target. Confirm this? – Michael - sqlbot Mar 21 '18 at 12:07
  • What is your motivation for /sbin/iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE? That seems a bit counter-intuitive though arguably it isn't wrong. Your next step should be using wireshark on both ends of the tunnel. – Michael - sqlbot Mar 21 '18 at 12:09
  • @Michael-sqlbot I had source/destination check set to true... After setting it to false everything works. Thank you very much! – mblichar Mar 21 '18 at 12:51

The VPC network is a software-defined network -- a layer 3 network that emulates Ethernet. By default, the network doesn't allow traffic to pass to or from an EC2 instance that doesn't have exactly that instance's address as source or destination address (depending on the direction of the traffic)... so the check must be disabled for cases like this one.

Changing the Source or Destination Checking

The Source/Destination Check attribute controls whether source/destination checking is enabled on the instance. Disabling this attribute enables an instance to handle network traffic that isn't specifically destined for the instance. For example, instances running services such as network address translation, routing, or a firewall should set this value to disabled. The default value is enabled.


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.