I have been a longtime OpenVPN. I have ran OpenVPN in the traditional way, but we tried to expand our setup after migrating some services to AWS.
We have an office network (192.168.1.x) [bad I know] and vpn network (192.168.67.x) and the AWS instance (54.214.239.236) that holds our public services. The AWS instance is a client of the OpenVPN server running in the router for the office. I tried to use client-to-client to make it so that rather than refering to this machine by its VPN ip, we can use DNS for the public, but have all users of our VPN connect to services on it via the VPN always.
server 192.168.67.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
push "route 54.214.239.236 255.255.255.255"
route 54.214.239.236 255.255.255.255
dev tun0
proto udp
keepalive 10 120
comp-lzo
dh /etc/openvpn/dh.pem
ca /etc/openvpn/ca.crt
cert /etc/openvpn/cert.pem
key /etc/openvpn/key.pem
client-config-dir /etc/openvpn/ccd
# crl-verify /etc/openvpn/ca.crl
verb 5
The contents of the AWS machines ccd file:
ifconfig-push 192.168.67.9 192.168.67.10
iroute 54.214.239.236 255.255.255.255
When this config is in place, we cannot connect to the AWS instance at all, I see the route added on the router as expected, we even see connections come in from the AWS instance:
Apr 30 05:01:58 m0n0 daemon.notice openvpn[16306]: MULTI: multi_create_instance called
Apr 30 05:01:58 m0n0 daemon.notice openvpn[16306]: 54.214.239.236:50511 Re-using SSL/TLS context
Apr 30 05:01:58 m0n0 daemon.notice openvpn[16306]: 54.214.239.236:50511 LZO compression initialized
Apr 30 05:01:58 m0n0 daemon.notice openvpn[16306]: 54.214.239.236:50511 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Apr 30 05:01:58 m0n0 daemon.notice openvpn[16306]: 54.214.239.236:50511 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Apr 30 05:01:58 m0n0 daemon.notice openvpn[16306]: 54.214.239.236:50511 TLS: Initial packet from 54.214.239.236:50511, sid=1744444f 5d315d37
Apr 30 05:02:58 m0n0 daemon.err openvpn[16306]: 54.214.239.236:50511 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Apr 30 05:02:58 m0n0 daemon.err openvpn[16306]: 54.214.239.236:50511 TLS Error: TLS handshake failed
Apr 30 05:02:58 m0n0 daemon.notice openvpn[16306]: 54.214.239.236:50511 SIGUSR1[soft,tls-error] received, client-instance restarting
If I comment out:
route 54.214.239.236 255.255.255.255
Everything works again, but obviously traffic doesn't go across the VPN. Any idea what would cause this? It is somewhere in the firewall/router rules. I have run out on my own. Thoughts?
