1

I've been unable to resolve this myself and really need some help as my networking knowledge isn't the strongest.

Setup: Flowchart of network

I want to be able to connect to the 10.8.0.2 client that is connected to OpenVPN from the application server at 10.0.0.2.

So far I've tried setting routes via ip route and iptables SNAT/DNAT with no success. net.ipv4.ip_forward is enabled on the the application server and the server that is hosting the OpenVPN server instance. I've also ensured that the proper FORWARD rules have been set with iptables that allows forwarded traffic from the /dev/tun0 to and from the /dev/eth0.

How should I go about doing this?

Thank you for your time <3

  • What IP routes do you have on the App Server? (does it know how to find the 10.8.0.1/24 network?) Same question for the VPN clients (when connected do they know how to get to the 10.0.0.0/24 network?). note This is nominally backwards for a typical client-device VPN scenario. Normally in a device-to-net VPN the device makes requests that are answered by the app servers (so that any NATing done by the VPN server is silently applied & handled). Is your VPN server routing & bridging the two networks together, or is it putting the VPN clients behind a hide NAT? – Ruscal Jan 28 at 17:02
  • Thanks, Ruscal. Yeah, this is a weird setup. I had not considered adding the routes to the clients as well, because when I attempted to sniff packets with tcpdump, I didn't see anything actually making it to the openvpn server. I had the route 10.8.0.0/24 via 10.0.0.3 set on the application server, with the 10.8.0.0/24 via 10.0.0.3 already set on the openvpn server by the openvpn server during setup. The VPN itself is behind 10.0.0.3, running as an application on that machine. So I think a packet travels from 10.0.0.2 -> 10.0.0.3 -> (internal route) -> 10.8.0.1 -> 10.8.0.2 – Trevor Miranda Jan 28 at 17:58
  • That route makes sense. With no packets showing it sounds like your being filtered at the OpenVPN server somewhere between the actual hardware (which should be getting packets with that route setup) and before OpenVPN software. Are you running any additional network stack on the server (a firewall perhaps, most OpenVPN setups are also running iptables [at least]) – Ruscal Jan 28 at 18:13
  • It's on AWS if that helps. I'm not sure what could be blocking it, and unfortunately ICMP is off the table so I can't see where exactly it's being blocked, before or after it actually hits the 10.0.0.3 interface :( I will investigate though and comment back if I notice that something is actively blocking the packets. – Trevor Miranda Jan 28 at 18:39
  • I should add, the application server and openvpn server are both within the same VPC on AWS. – Trevor Miranda Jan 28 at 18:43

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.