This has also been posted over at
ServerFault
We are trying to configure an OpenVPN tunnel that allows devices on our LAN to communicate with servers in an Amazon VPC. We are using the turnkey OpenVPN access server instance on Amazon and have followed documentation to set up our local server as a Gateway.
Image of configuration: http://imgur.com/Y33PdJU
The Amazon server is able to communicate with Router A on our LAN without issue (ping, ssh), however when we try to ping from Router A to the private IP of the server, it does not get through. Using tcpdump we see the echo request on Gateway A's eth0 interface, but we do not see anything on the tun1 interface. It seems like it is not being properly forwarded to the tun0 interface. Using OpenVPN's configuration we have made it so that clients should be able to act as a Gateway.
Where are we going wrong? More details below.
Left Side Gateway
netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 10.23.0.1 0.0.0.0 UG 0 0 0 wlan0
10.0.0.2 10.0.2.1 255.255.255.255 UGH 0 0 0 tun1
10.0.1.0 10.0.2.1 255.255.255.0 UG 0 0 0 tun1
10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 tun1
10.23.0.0 0.0.0.0 255.255.240.0 U 0 0 0 wlan0
54.208.149.66 10.23.0.1 255.255.255.255 UGH 0 0 0 wlan0
172.16.0.0 172.16.0.1 255.255.0.0 UG 0 0 0 tap0
192.168.0.0 192.168.10.100 255.255.0.0 UG 0 0 0 eth0
sudo iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ip route
default via 10.23.0.1 dev wlan0 proto static
10.0.0.2 via 10.0.2.1 dev tun1 metric 101
10.0.1.0/24 via 10.0.2.1 dev tun1 metric 101
10.0.2.0/24 dev tun1 proto kernel scope link src 10.0.2.12
10.23.0.0/20 dev wlan0 proto kernel scope link src 10.23.3.197 metric 9
54.208.149.66 via 10.23.0.1 dev wlan0
172.16.0.0/16 via 172.16.0.1 dev tap0
192.168.0.0/16 via 192.168.10.100 dev eth0
OpenVPN config
setenv FORWARD_COMPATIBLE 1
client
proto tcp
remote vpn.xxx.com
port 3389
dev tun
dev-type tun
ns-cert-type server
reneg-sec 604800
sndbuf 100000
rcvbuf 100000
# NOTE: LZO commands are pushed by the Access Server at connect time.
# NOTE: The below line doesn't disable LZO.
comp-lzo no
verb 3
setenv PUSH_PEER_INFO
ip rule
0: from all lookup local
220: from all lookup 220
32766: from all lookup main
32767: from all lookup default
ifconfig
eth0 Link encap:Ethernet HWaddr 44:8a:5b:57:a7:68
inet addr:192.168.10.100 Bcast:192.168.10.255 Mask:255.255.255.0
inet6 addr: fe80::468a:5bff:fe57:a768/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:96265 errors:0 dropped:103 overruns:0 frame:0
TX packets:42772 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:15112811 (15.1 MB) TX bytes:6396552 (6.3 MB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:1420458 errors:0 dropped:0 overruns:0 frame:0
TX packets:1420458 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:339956597 (339.9 MB) TX bytes:339956597 (339.9 MB)
tap0 Link encap:Ethernet HWaddr a6:0a:3c:76:bd:33
inet addr:172.16.0.1 Bcast:172.16.0.255 Mask:255.255.255.0
inet6 addr: fe80::a40a:3cff:fe76:bd33/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:138694 errors:0 dropped:1155 overruns:0 frame:0
TX packets:118026 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:49993976 (49.9 MB) TX bytes:25231042 (25.2 MB)
tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.0.2.11 P-t-P:10.0.2.11 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:9 errors:0 dropped:0 overruns:0 frame:0
TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1260 (1.2 KB) TX bytes:1372 (1.3 KB)
wlan0 Link encap:Ethernet HWaddr 40:f0:2f:8f:51:5c
inet addr:10.23.3.197 Bcast:10.23.15.255 Mask:255.255.240.0
inet6 addr: fe80::42f0:2fff:fe8f:515c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2205804 errors:0 dropped:0 overruns:0 frame:0
TX packets:1773520 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1823901987 (1.8 GB) TX bytes:273830921 (273.8 MB)
Right Side Gateway
OpenVPN Access Server Version: 2.0.8
Accepting VPN client connections on IP address: all interfaces
Port for VPN client connections: tcp/3389
OSI Layer: 3 (routing/NAT)
Clients access private subnets using: Routing
openvpnas@openvpnas2:/var/log$ netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 10.0.1.1 0.0.0.0 UG 0 0 0 eth0
10.0.1.0 10.0.1.128 255.255.255.0 UG 0 0 0 eth0
10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 as0t0
172.16.0.0 0.0.0.0 255.255.0.0 U 0 0 0 as0t0
192.168.0.0 0.0.0.0 255.255.0.0 U 0 0 0 as0t0
