what setup is required on the server for global routing ?

twjnorth1971

Currently when a user connects using OpenVPN AS server to Amazon AWS, the security groups permit access based on the IP Address of the VPN Server, not the IP address given to the client by the VPN server.

This seems to be the same as mentioned here https://openvpn.net/index.php/access-server/docs/admin-guides-sp-859543150/howto-administration/215-how-to-setup-routing-in-openvpn-access-server.html

On the previously mentioned page, it indicates this can be changed by using Advanced Routing.

Yes, using routing (advanced): VPN Clients can access private subnets, and it is the virtual address of each VPN Client that is used as the source address on client packets destined for private subnets. Routing must be configured on hosts on the private subnet(s) so that response packets can be routed back to the VPN Clients via the Access Server host's IP address on the private subnet.

Problem is, it says yes you can do it but then doesnt provide any information or links to what needs to be setup on the server.
So my question is where can i find out the information about what needs to be configured on the server side (in OpenVPN AS or iptables) to support this ?

Thanks in advance.

gearond

My guess, and I'm a newbie, is that you should put the whole virtual address range assignable by openvpn as source and destination in the routing tables of your VPC's subnets. If possible, use a global routing table to give the connection access to all servers if that is your purpose.

I am working at understanding things myself, however. As my later posts will show today.

The Johan

OpenVPN Technologies support here.

The page you have linked to does indeed set things up so that the VPN clients IP addresses are visible to devices on your network. That's pretty much all the work that needs to be done in the Access Server. However, AWS uses security groups which function as firewalls and they do source checking. They block stuff they don't know, basically.

So you need to disable source checking and you need to allow those subnets through in the security groups. This guide here may be of some use to you in configuring this on AWS. Please read the whole thing.
https://docs.openvpn.net/how-to-tutorialsguides/virtual-platforms/amazon-ec2-appliance-ami-quick-start-guide/

Good luck.