The goal here is to be able to VPN into my OpenVPN server on Amazon Web Services and then SSH into the servers on the internal side of the network. Basically having a gateway, then able to SSH into the other servers on AWS. I can avoid having a bunch of elastic/static IPs this way, and limit access. I already had an instance I wanted to put OpenVPN on, so I installed it and easy-rsa via yum rather than use the image in the marketplace.
Currently I am able to connect via OpenVPN from my OSX 10.9 machine into the AWS server (RHEL 6) but when I go to SSH into the server that I have VPN'd into with the .pem key, it fails.
ssh -i <filename>.pem ec2user@<ipaddy>
I get: Permission denied (publickey,gssapi-keyex,gssapi-with-mic). And I am sure that is the correct key.
Additionally, I am not able to access the internet via the connection. When I connect it appears as if the DNS servers are not working (using the google ones).
I'm sure there is a problem with how I configured it with the routing, or something. I'm not sure if the proper way to post the contents is in the 'code' tags, forgive me if it isn't.
CLIENT:
client
dev tun
proto tcp
remote 54.84.24.191 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo
verb 3
auth-user-pass
remote-cert-tls server
server.conf
port 443
proto tcp
dev tap
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
IPTables
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [1:328]
:OUTPUT ACCEPT [1:328]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [806017:319176778]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 943 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
Thanks in advance:
sj3k
