1

I'm interested in setting up a VPN server on Amazon EC2 to act as a VPN server. It's important that clients connecting to the VPN get an IP from the AWS VPC so that we can establish connectivity to and from any EC2 servers to the VPN clients.

The use case is offloading development environments to a Kubernetes cluster running in the cloud, while still running some code locally.

Currently, we have a VPN setup with Softether that uses DNSMasq to provide a local DHCP server. Our EC2 servers get an IP in the range 10.x.x.x.x range , but VPN clients get an IP in the 192.168.x.x. range, which prevents EC2 servers from sending traffic directly to the VPN clients.

Since I'm not well versed in networking, I'm not sure how to accomplish this. Can anybody give me some pointers?

2

The fact that you've got the VPC (EC2) IP range 10.x.x.x (for example 10.20.0.0/16) and the VPN IP range 192.168.x.x (for example 192.168.123.0/24) doesn't in any way preclude these two networks from talking to each other. However there is a couple of steps that you have to complete first.

I understand that at the moment you can connect from the VPN to the EC2 instances but not from EC2 to the VPN clients, correct? And you have SoftEther VPN gateway on one of the EC2 instances, for example on 10.20.30.40, instance i-123vpnvpn, correct?

So to summarise:

  • VPC / EC2 IP range: 10.20.0.0/16
  • VPN IP range: 192.168.123.0/24
  • SoftEther gateway: 10.20.30.40, instance id i-123vpnvpn

To enable connections from EC2 to VPN make sure that all this is configured:

  1. The VPC Route Table must have an entry for 192.168.123.0/24 pointing to the SoftEther instance i-123vpnvpn. This will let Amazon know that when EC2 instances want to talk to VPN IPs the packets must be routed to the SoftEther instance first.

  2. Disable Src/Dst Check in the SoftEther instance configuration in EC2 console. EC2 instances by default can't receive traffic that's not meant for them, i.e. they can't act as routers. Disabling Src/Dst Check relaxes this restriction and enables the instance to route traffic between 10.20.0.0/16 and 192.168.123.0/24.

  3. Adjust SoftEther's configuration and firewall to enable incoming connections from outside (= EC2) to the VPN. Very often this is disabled on VPN gateways for security purposes. I don't know SoftEther so can't help with the details on how to do that.

  4. Open SoftEther's EC2 Security Group for all traffic from 10.20.0.0/16.

  5. (Optionally) Disable NAT on the SoftEther instance. At the moment all traffic from the VPN is probably translated from the 192.168.123.0/24 range to the SoftEther's EC2 IP 10.20.30.40. Disabling NAT (Network Address Translation) will expose the original VPN addresses to the EC2 instances.

That should be enough to enable traffic both ways between the VPC and the VPN. As you can see there is quite a lot of moving parts. Good luck with that!

Hope that helps :)

|improve this answer|||||
  • Just wanted to say thanks for the detailed description – this is exactly what I need to investigate this further. Glad you took the time to write this down in such an understandable manner, really helpful! – Simon Fredsted Feb 17 '19 at 10:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.