OpenVPN Hosed after Reboot in AWS

mike.mckinney

Hey folks,

I'm running into an issue where I rebooted our OpenVPN access server, and now we're not able to make any connections to the subnet it serves at all.

OpenVPN server ip 172.31.17.133
OpenVPN Client ip 172.27.232.3
Block of addresses assigned to clients 172.27.224.0/20
Target server (one being accessed) 172.31.3.210
Block of VPC IP's 172.31.0.0/16

So far this is what I've determined using tcpdump. The client generates the request, the vpnserver sees that request, forwards it, the target server generates the response, but the vpn server drops/doesn't see that response.

Client tcp dump http://pastebin.com/EvXstHKU
VPN Server tcpdump http://pastebin.com/tHjgbwMs
Target Server tcpdump http://pastebin.com/2NUPdSq5
IP tables config http://pastebin.com/fZd6Z8Qp
OpenVPN config http://pastebin.com/4fuZVGjn

Check/Source Destination is unchecked on vpn server's eth adapter, ipv4 forwarding is enabled, security groups are all open. I got nothing. Seriously stumped here. Anyone have an idea of what I can try? Thanks.

mike.mckinney

Fixed it!

NAT wasn't working properly. Once i looked over the client tcpdump again i realized it was responding to the client ip, which it should have been responding to the vpn server.

This fixed it so that nat was applied to packets coming from the client. This fixed this issue.

sudo iptables -t nat -I POSTROUTING -o eth0 -s 172.27.224.0/20 -j MASQUERADE