I have a OpenVPN AS instance (AWS). I am trying to route traffic from my VPC ( to home (

What works: I can route ALL traffic from home ( via to

ROUTE: ANY Source to Dest via 

What does not work: I cannot route all traffic from AWS ( to

Example I cannot ping from Server AWS) to RasPi OpenVPN Client). When I do a tcpdump from OpenVPN Server) for ping packets, I get nothing.

ROUTE: Dest via

What I have done to troubleshoot

-OpenVPN Server Dest Check is disabled

-VPC, Routing Tables, I created a route to via dest OpenVPn Server Instance see screenshot

enter image description here

Route Table from AWS OpenVPN Server (cannot reach

default via dev eth0 : dev as0t0 proto kernel scope link src dev as0t1 proto kernel scope link src dev eth0 proto kernel scope link src dev as0t1 proto static

Route Table From Home OpenVPN Client can reach

default via dev eth0 onlink via dev eth0 via dev tun0 metric 101 dev tun0 proto kernel scope link src via dev tun0 metric 101 dev eth0 proto kernel scope link src

  • Good test by adding a static route to one of the other instances. Because of this, you have to have something wrong in the route tables. Do you have more than one route table? If so, did you make sure your subnet is associated with the proper route table? Sounds like you're close. Jul 26, 2017 at 4:01
  • Updated my post above. Please see. Jul 26, 2017 at 15:42
  • Ok, thanks. I have a thought that I think is related. I'll think about this more and explain later when I have more time. But, can you please clean up your post with proper code blocks and formatting? I'm getting a headache trying to read your command outputs all on one line. Jul 26, 2017 at 16:23
  • Sure I apologize about that Jul 26, 2017 at 16:34
  • Cleaned up post Jul 26, 2017 at 17:09

3 Answers 3


Did you disable Source-Destination Checking: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#change_source_dest_check?

  • This did the trick for me!
    – Natan
    Aug 21, 2019 at 18:35
  • @Natan Your question mentions source/dest checking is disabled. But this is the answer?
    – Mukus
    Jan 25, 2022 at 3:08

At first glance it looks like you might have forgotten to update the security group of the VPN server to accept traffic from the other instances in the VPC. To test, could you edit the security group that the AWS VPN instance is in and add a rule that allows all traffic from

I think this is the problem because security groups act as a stateful firewall. This means that when the AWS VPN instance sends traffic out from home to other AWS instances, the security group will automatically allow the return traffic. But when traffic is initiated by another instance in AWS with a destination of your home network, there will be no rule in the AWS VPN instance's security group to allow the traffic. This is why traffic from home can reach AWS, but the reverse doesn't work.

If the security groups weren't the problem could you...

Please enable VPC flowlogs within your VPC configuration. This will log netflow like information to CloudWatch Logs. We can use this for troubleshooting the AWS side of the traffic.

Could you drill down into which of these situations work / don't work:

  • Can you ping the home end of the tunnel from the AWS VPN instance?

  • Can you ping the home end of the tunnel from another AWS instance?

  • Can you ping another home machine from the AWS VPN instance?

  • Can you ping another home machine from another AWS instance?

Include a traceroute from another AWS instance to another home machine.


VPC drops packets if the IP rage is outside of its CIDR block. Use Routing method in OpenVPN and Transit Gateway to setup the VPC routes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .