0

I have a OpenVPN AS instance (AWS). I am trying to route traffic from my VPC (172.31.10.0/20) to home (192.168.5.0/24).

What works: I can route ALL traffic from home (192.168.5.0/24) via 192.168.5.4 to 172.31.10.0/20

ROUTE: ANY Source to Dest 172.31.10.0/20 via 192.168.5.4

What does not work: I cannot route all traffic from AWS (172.31.10.0/20)via 172.31.10.5 to 192.168.5.0/24

Example I cannot ping from 172.31.10.15(Win Server AWS) to 192.168.5.4( RasPi OpenVPN Client). When I do a tcpdump from 172.31.10.5( OpenVPN Server) for ping packets, I get nothing. 

ROUTE: Dest 192.168.5.0/24 via 172.31.10.5

What I have done to troubleshoot

-OpenVPN Server Dest Check is disabled

-VPC, Routing Tables, I created a route to 192.168.5.0/24 via dest OpenVPn Server Instance 172.31.10.5. see screenshot

enter image description here

Route Table from AWS OpenVPN Server 172.31.10.5 (cannot reach 192.168.5.4):

default via 172.31.10.1 dev eth0 : 172.27.224.0/21 dev as0t0 proto kernel scope link src 172.27.224.1

172.27.232.0/21 dev as0t1 proto kernel scope link src 172.27.232.1

172.31.10.0/20 dev eth0 proto kernel scope link src 172.31.10.5

192.168.5.0/24 dev as0t1 proto static

Route Table From Home OpenVPN Client 192.168.5.4(which can reach 172.31.10.0/20):

default via 192.168.5.254 dev eth0 onlink

13.59.64.181 via 192.168.5.254 dev eth0

172.27.224.0/20 via 172.27.232.1 dev tun0 metric 101

172.27.232.0/21 dev tun0 proto kernel scope link src 172.27.232.5

172.31.0.0/16 via 172.27.232.1 dev tun0 metric 101

192.168.5.0/24 dev eth0 proto kernel scope link src 192.168.5.4

|improve this question
  • Good test by adding a static route to one of the other instances. Because of this, you have to have something wrong in the route tables. Do you have more than one route table? If so, did you make sure your subnet is associated with the proper route table? Sounds like you're close. – Appleoddity Jul 26 '17 at 4:01
  • Updated my post above. Please see. – Benjamin Jones Jul 26 '17 at 15:42
  • Ok, thanks. I have a thought that I think is related. I'll think about this more and explain later when I have more time. But, can you please clean up your post with proper code blocks and formatting? I'm getting a headache trying to read your command outputs all on one line. – Appleoddity Jul 26 '17 at 16:23
  • Sure I apologize about that – Benjamin Jones Jul 26 '17 at 16:34
  • Cleaned up post – Benjamin Jones Jul 26 '17 at 17:09
1

At first glance it looks like you might have forgotten to update the security group of the VPN server to accept traffic from the other instances in the VPC. To test, could you edit the security group that the AWS VPN instance is in and add a rule that allows all traffic from 172.31.10.0/20.

I think this is the problem because security groups act as a stateful firewall. This means that when the AWS VPN instance sends traffic out from home to other AWS instances, the security group will automatically allow the return traffic. But when traffic is initiated by another instance in AWS with a destination of your home network, there will be no rule in the AWS VPN instance's security group to allow the traffic. This is why traffic from home can reach AWS, but the reverse doesn't work.

If the security groups weren't the problem could you...

Please enable VPC flowlogs within your VPC configuration. This will log netflow like information to CloudWatch Logs. We can use this for troubleshooting the AWS side of the traffic.

Could you drill down into which of these situations work / don't work:

  • Can you ping the home end of the tunnel from the AWS VPN instance?

  • Can you ping the home end of the tunnel from another AWS instance?

  • Can you ping another home machine from the AWS VPN instance?

  • Can you ping another home machine from another AWS instance?

Include a traceroute from another AWS instance to another home machine.

|improve this answer
0

Did you disable Source-Destination Checking: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#change_source_dest_check?

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.