AWS OpenVPN Routing

Question

I have a OpenVPN AS instance (AWS). I am trying to route traffic from my VPC (172.31.10.0/20) to home (192.168.5.0/24).

What works: I can route ALL traffic from home (192.168.5.0/24) via 192.168.5.4 to 172.31.10.0/20

ROUTE: ANY Source to Dest 172.31.10.0/20 via 192.168.5.4 

What does not work: I cannot route all traffic from AWS (172.31.10.0/20)via 172.31.10.5 to 192.168.5.0/24

Example I cannot ping from 172.31.10.15(Win Server AWS) to 192.168.5.4( RasPi OpenVPN Client). When I do a tcpdump from 172.31.10.5( OpenVPN Server) for ping packets, I get nothing.

ROUTE: Dest 192.168.5.0/24 via 172.31.10.5

What I have done to troubleshoot

-OpenVPN Server Dest Check is disabled

-VPC, Routing Tables, I created a route to 192.168.5.0/24 via dest OpenVPn Server Instance 172.31.10.5. see screenshot

---

Route Table from AWS OpenVPN Server 172.31.10.5 (cannot reach 192.168.5.4):

default via 172.31.10.1 dev eth0 : 172.27.224.0/21 dev as0t0 proto kernel scope link src 172.27.224.1

172.27.232.0/21 dev as0t1 proto kernel scope link src 172.27.232.1

172.31.10.0/20 dev eth0 proto kernel scope link src 172.31.10.5

192.168.5.0/24 dev as0t1 proto static

Route Table From Home OpenVPN Client 192.168.5.4(which can reach 172.31.10.0/20):

default via 192.168.5.254 dev eth0 onlink

13.59.64.181 via 192.168.5.254 dev eth0

172.27.224.0/20 via 172.27.232.1 dev tun0 metric 101

172.27.232.0/21 dev tun0 proto kernel scope link src 172.27.232.5

172.31.0.0/16 via 172.27.232.1 dev tun0 metric 101

192.168.5.0/24 dev eth0 proto kernel scope link src 192.168.5.4

Answer 1

At first glance it looks like you might have forgotten to update the security group of the VPN server to accept traffic from the other instances in the VPC. To test, could you edit the security group that the AWS VPN instance is in and add a rule that allows all traffic from 172.31.10.0/20.

I think this is the problem because security groups act as a stateful firewall. This means that when the AWS VPN instance sends traffic out from home to other AWS instances, the security group will automatically allow the return traffic. But when traffic is initiated by another instance in AWS with a destination of your home network, there will be no rule in the AWS VPN instance's security group to allow the traffic. This is why traffic from home can reach AWS, but the reverse doesn't work.

If the security groups weren't the problem could you...

Please enable VPC flowlogs within your VPC configuration. This will log netflow like information to CloudWatch Logs. We can use this for troubleshooting the AWS side of the traffic.

Could you drill down into which of these situations work / don't work:

• Can you ping the home end of the tunnel from the AWS VPN instance?

• Can you ping the home end of the tunnel from another AWS instance?

• Can you ping another home machine from the AWS VPN instance?

• Can you ping another home machine from another AWS instance?

Include a traceroute from another AWS instance to another home machine.

Answer 2

Did you disable Source-Destination Checking: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#change_source_dest_check?