I've been unable to resolve this myself and really need some help as my networking knowledge isn't the strongest.

Setup: Flowchart of network

I want to be able to connect to the client that is connected to OpenVPN from the application server at

So far I've tried setting routes via ip route and iptables SNAT/DNAT with no success. net.ipv4.ip_forward is enabled on the the application server and the server that is hosting the OpenVPN server instance. I've also ensured that the proper FORWARD rules have been set with iptables that allows forwarded traffic from the /dev/tun0 to and from the /dev/eth0.

How should I go about doing this?

Thank you for your time <3

  • What IP routes do you have on the App Server? (does it know how to find the network?) Same question for the VPN clients (when connected do they know how to get to the network?). note This is nominally backwards for a typical client-device VPN scenario. Normally in a device-to-net VPN the device makes requests that are answered by the app servers (so that any NATing done by the VPN server is silently applied & handled). Is your VPN server routing & bridging the two networks together, or is it putting the VPN clients behind a hide NAT? – Ruscal Jan 28 '19 at 17:02
  • Thanks, Ruscal. Yeah, this is a weird setup. I had not considered adding the routes to the clients as well, because when I attempted to sniff packets with tcpdump, I didn't see anything actually making it to the openvpn server. I had the route via set on the application server, with the via already set on the openvpn server by the openvpn server during setup. The VPN itself is behind, running as an application on that machine. So I think a packet travels from -> -> (internal route) -> -> – Trevor Miranda Jan 28 '19 at 17:58
  • That route makes sense. With no packets showing it sounds like your being filtered at the OpenVPN server somewhere between the actual hardware (which should be getting packets with that route setup) and before OpenVPN software. Are you running any additional network stack on the server (a firewall perhaps, most OpenVPN setups are also running iptables [at least]) – Ruscal Jan 28 '19 at 18:13
  • It's on AWS if that helps. I'm not sure what could be blocking it, and unfortunately ICMP is off the table so I can't see where exactly it's being blocked, before or after it actually hits the interface :( I will investigate though and comment back if I notice that something is actively blocking the packets. – Trevor Miranda Jan 28 '19 at 18:39
  • I should add, the application server and openvpn server are both within the same VPC on AWS. – Trevor Miranda Jan 28 '19 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.