I have an Amazon Virtual Private Cloud that looks like this:   Internet Gateway   My OpenVPN Instance My Windows Box

What I want is traffic from the Windows box destined for network to route through my OpenVPN Instance (, but for the life of me I cannot make it go.

  1. The Windows Box can ping the OpenVPN Instance. The subnet and instances have appropriate firewall rules.

  2. To test routing I run "ping" from the Windows box and watch the output of tcpdump on the OpenVPN Instance. This technique works on my local physical LAN.

  3. To the VPC route table I added a route for to go to the OpenVPN Instance, but they never arrive.

  4. On the Windows box I tried adding the same route. Using wireshark I verified that ping packets are destined to the OpenVPN Instance's MAC address. But no cigar.

Do VPC subnets even allow this kind of routing?

  • 2
    Of course VPC subnets allow this kind of routing. It's a subnet. It's a layer 3 network between each of these hosts. How could it not allow it? It's not VPC that's preventing this from working; it's software on one of your boxen. Sounds like a firewall problem. You're probably filtering ICMP. – allquixotic Jan 28 '14 at 17:09

Finally got it: disable Source/dest check. The default is "enabled" which will discard any incoming packet if the destination address does not match the instance address. This of course prevents a router from working.

| improve this answer | |
  • I banged my head for hours because of this frickin option. I would upvote you 10 times if I could. – Oktav Oct 21 '14 at 10:19
  • Weird this didn't help me... Disabling the check still leads to no route to host. – Kevin Parker Mar 30 '16 at 4:32
  • same here @Oktav I was beginning to doubt my profession ;) – Michael Noyb Feb 17 '17 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.