Hello everybody, hoping you could spare some time and help me figure this one out...thanking you in advance 😃
I have a test environment setup on AWS as follows:
- VPC-1:
- OVPN server instance: 10.100.1.4/28
Server A instance: 10.100.1.5/28
VPC-2:
- Server B instance: 10.10.10.13/24
VPC-1 peered with VPC-2 (VPC Peering between VPC1 and VPC2)
Here is the server.config
port 443
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.100.1.8 255.255.255.248
ifconfig-pool-persist ipp.txt
push "route 10.100.1.0 255.255.255.0"
push "route 10.10.0.0 255.255.0.0"
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn-status.log
Route table on OVPN Server
[root@ip-10-100-1-4 ec2-user]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.100.1.1 0.0.0.0 UG 1024 0 0 eth0
10.100.1.0 0.0.0.0 255.255.255.240 U 0 0 0 eth0
10.100.1.8 10.100.1.10 255.255.255.248 UG 0 0 0 tun0
10.100.1.10 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
Routing table at VPC-1
Destination Target
10.100.1.0/24 local
0.0.0.0/0 Internet gateway
10.10.0.0/16 VPC Peering Link
Routing table at VPC-2
Destination Target
10.10.0.0/16 local
0.0.0.0/0 Internet gateway
10.100.1.0/24 VPC Peering link
What works
VPN clients can ping tun0 and eth0
VPN clients can ping server A
Test server A can ping VPN clients
OVPN server and Server A can ping Server B
Server B can ping OVPN and Server A
Problem
- The VPN client can't ping server B
Server B can't ping VPN client
tcpdump on tun0 and eth0 interface on OVPN Server when vpn-client pinging Server B.
[root@ip-10-100-1-4 ec2-user]# tcpdump -i any host 10.10.10.31 -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
11:04:26.568926 IP 10.100.1.14 > 10.10.10.31: ICMP echo request, id 1, seq 141, length 40
11:04:26.568936 IP 10.100.1.14 > 10.10.10.31: ICMP echo request, id 1, seq 141, length 40
11:04:31.196815 IP 10.100.1.14 > 10.10.10.31: ICMP echo request, id 1, seq 142, length 40
11:04:31.196829 IP 10.100.1.14 > 10.10.10.31: ICMP echo request, id 1, seq 142, length 40
11:04:36.198670 IP 10.100.1.14 > 10.10.10.31: ICMP echo request, id 1, seq 143, length 40
11:04:36.198683 IP 10.100.1.14 > 10.10.10.31: ICMP echo request, id 1, seq 143, length 40
11:04:41.198007 IP 10.100.1.14 > 10.10.10.31: ICMP echo request, id 1, seq 144, length 40
11:04:41.198018 IP 10.100.1.14 > 10.10.10.31: ICMP echo request, id 1, seq 144, length 40
This shows that the packets are reaching tun0, then eth0. tcpdump on Server B is empty.
When Server B pings a vpn-client, no echo request packets reach the OVPN Server.
Any help or directions for troubleshooting would be greatly appreciated!!
