Basic Layout:

  • VPC has IP range
  • 2 EC2s on subnet
    • First with RRAS providing IP addresses to VPN clients (range
    • Second just a test machine to receive pings
  • Other subnets unrelated to this question, etc.

IP addresses:

RRAS Server LAN side:
Test machine: 
RRAS Server VPN Side:
Client #1:    

Specifications of VPN:

Remote clients should only be able to use the VPN to access computers on the subnet and should not be able to browse the internet through the VPN. This will require the clients to set up split tunnelling, this is okay.


The current issue at hand is that I cannot get the ping packets to go where I want them. I have Wireshark set up on both machines but packets simply aren't making it to the test machine.

Example Pings:

Client #1:
a. ping     [success]
b. ping    [success]
c. ping     [fail]

With ping c I see the ping in Wireshark on the RRAS side, but it is never received on the Test machine. Wireshark gives the error: "no response found!"

I imagine that I have misconfigured the VPC and thus packets from the subnet are either:

  1. Being dropped by the VPC because they are coming from an unexpected subnet, or
  2. There are no routes in place to tell the VPC where to send them so they simply get lost

I have been able to get this working by enabling a public NAT, however we do not want all of our staff connecting to the internet through this VPN and racking up large data transfer charges.


Turns out I just had to disable Source/Destination Check in the EC2 Console.

This can be done by selecting the EC2 Instance, then from the Actions menu, Networking > Change Source/Dest Check


A few other changes that were made were

  1. VPN Subnet changed to (outside of the VPC)
  2. Route Added to VPC pointing to the VPN instance

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.