justingreene
I have setup openVPN on an Ubuntu instance (VPN Server) in an AWS VPC. I am routing, not bridging. My VPN client network is 172.16.100.0/24 and the VPC network is 10.0.0.0/24. I have added a route to the VPN Server in the Route Table for the VPC in AWS. The VPN server is pushing the route to the VPC properly. I can connect to the VPN Server from a client without a problem. I can ping the 10.0.0.x address of the VPN Server from the client without problem. I can connect to instances in the VPC via SSH (and other TCP based protocols) from the VPN client without a problem. However Pinging the instances in the VPC does not work, not do UDP based services (such as Mosh) unless I:
1. Enable IP Masquerading on the VPN Server
or
2. Manually enter the Route to the VPN Server on each instance
Without 1 or 2 above, if I initiate a Ping from the VPN client to a VPC.
1. tcpdump on the VPN Server show the ICMP request: VPN Client IP -> Instance IP
2. tcpdump on the VPC Instance shows the ICMP request: VPN Client IP -> Instance IP and Instance IP -> VPN Client IP
3. however the Instance IP -> VPN client IP reply does not seem to reach the VPN Server unless I add the route to the instance manually.
So the PING is reaching the VPC instance, but the reply is not reaching the VPN Server.
Any ideas on why this is happening? Do I HAVE to add the route to each instance in order for this to work?
Is it a shortcoming in AWS APC Route tables?
Is it just a function of TCP v. UDP v. ICMP routing or routing in AWS?
Thanks,
Justin
justingreene
"I have added a route to the VPN Server in the Route Table for the VPC in AWS."
I did add a static route from the vpc to the vpnserver and it works properly which is why tcp routes properly. That's why I am confused. Tcp works but not icmp or udp. Those only work when I add a static route to the instances themselves.
