Routing Only AWS S3 traffic through OpenVPN AS

himerzi

I have an OpenVPN server hosted on an EC3 instance running in an AWS VPC with private and public subnets (the VPN server is on the public subnet). I would like for client's internet traffic to not be routed through the VPN unless it is destined for Amazon AWS, or an address within the VPC subnet.

I've attempted to get this working with the following rules, but haven't had any success.

Server Config Directives (added via OpenVPN AS admin interface):

push "route amazon.com vpn_gateway"
push "route 0.0.0.0 0.0.0.0 net_gateway"
Additionally, client traffic is set to not be routed through the VPN, but clients are able to access network services on the VPN gateway IP address.

Client config:

# Automatically generated OpenVPN client config file
# Generated on Wed Apr  6 15:28:38 2016 by openvpnas2
# Note: this configuration is user-locked to the username below
# OVPN_ACCESS_SERVER_USERNAME=md
# Define the profile name of this particular configuration file
# OVPN_ACCESS_SERVER_PROFILE=md@uyk.com
# OVPN_ACCESS_SERVER_CLI_PREF_ALLOW_WEB_IMPORT=True
# OVPN_ACCESS_SERVER_CLI_PREF_BASIC_CLIENT=False
# OVPN_ACCESS_SERVER_CLI_PREF_ENABLE_CONNECT=True
# OVPN_ACCESS_SERVER_CLI_PREF_ENABLE_XD_PROXY=True
# OVPN_ACCESS_SERVER_WSHOST=uyk.com:943
# OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_START
# OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_STOP
# OVPN_ACCESS_SERVER_IS_OPENVPN_WEB_CA=0
# OVPN_ACCESS_SERVER_ORGANIZATION=OpenVPN Technologies, Inc.
setenv FORWARD_COMPATIBLE 1
client
proto udp
nobind
remote uyk.com
port 443
dev tun
dev-type tun
ns-cert-type server
reneg-sec 604800
sndbuf 100000
rcvbuf 100000
auth-user-pass
static-challenge "Enter Google Authenticator Code" 1
# NOTE: LZO commands are pushed by the Access Server at connect time.
# NOTE: The below line doesn't disable LZO.
comp-lzo no
verb 3
setenv PUSH_PEER_INFO

Why isn't client traffic to console.aws.amazon.com being routed through the VPN?

rsenio

There is a setting specifically for this.

VPN Settings

Should client Internet traffic be routed through the VPN?

No

Yes

martincampbell

How about a scenario where I only want S3 traffic sent through the VPN and not the rest of the internet traffic? E.g. I have a static S3 website that I only want to be available when people are in the office or on VPN. I can whitelist the office IP at AWS but I don't want my VPN users to be running all traffic through VPN - just stuff destined for the VPC or S3

The Johan

You should be able to go to VPN Settings > Allow access to private subnets > Yes, using NAT, and specify the IP ranges there in CIDR notation. If that doesn't work contact the support ticket system at www.openvpn.net and ask for support.

martincampbell

Thanks Novaflash I'll have look - only problem is S3 IP ranges do change. But I'll try this and see if it works before I worry about Amazon changing their IPs.

The Johan

Well, we can't help that, unfortunately. It's not like it can magically know these ranges and update itself. I guess you'll just have to update the settings when these changes occur.