Hello,
I am having troubles with routing back to my LAN from a server in AWS using two Linux servers (client-server site-to-site: not OpenVPN Access Server)
Here is my setup:
External IPs redacted
CLIENT:
Ubuntu 16.04.3 LTS
LAN IP: 172.19.20.1
OVPN: 172.19.65.6
SERVER (EC2 at AWS):
Ubuntu 16.04.3 LTS
LAN IP: 10.240.5.200
OVPN: 172.19.65.1
OpenVPN Network: 172.19.65.0 netmask 255.255.255.0
From the client (172.19.65.6) i can ping the server on either IP (OpenVPN 172.19.65.1 or LAN IP 10.240.5.200).
From the server (172.19.65.1) i can ping the client, but only the OpenVPN client IP (172.19.65.6). When I ping the client LAN ip or computer on that subnet (172.19.20.1) it fails (goes nowhere).
TCPDump reveals the traffic is successfully going across the VPN from the client to the server on the VPN interface. Same for the reverse: works on the VPN interfaces (tun0). From the client to the server, i can reach the LAN on the server side. But the last remaining piece is to be able to reach the client LAN from the server.
I cannot reach my client subnet from the server. The routes are properly configured.
This configuration works perfectly in a non AWS environment. Even when adding the correct routes in the VPC route table, i'm still unable to reach the client subnet. My Source/Destination check is disabled on the EC2 ENI (as per the requirements). No matter what I try, i cannot reach the client LAN IP from the Server (even though i can reach the VPN client IP).
Here are the routes:
root@CLIENT:~# ip route show
default via 172.19.20.1 dev ens160 onlink
10.240.5.0/24 via 172.19.65.5 dev tun0
172.19.20.0/24 dev ens160 proto kernel scope link src 172.19.20.1
172.19.65.1 via 172.19.65.5 dev tun0
172.19.65.5 dev tun0 proto kernel scope link src 172.19.65.6
root@SERVER:/# ip route show
default via 10.240.5.129 dev eth0
10.240.5.128/25 dev eth0 proto kernel scope link src 10.240.5.200
172.19.20.0/24 via 172.19.65.2 dev tun0
172.19.65.0/24 via 172.19.65.2 dev tun0
172.19.65.2 dev tun0 proto kernel scope link src 172.19.65.1
My OpenVPN Server config is as follows:
local 10.240.5.200
dev tun
proto tcp
port 443
ca /etc/openvpn/ca.crt
cert /etc/openvpn/file.crt
key /etc/openvpn/file.key
dh /etc/openvpn/file.pem
user nobody
group nogroup
server 172.19.65.0 255.255.255.0
push "route 172.19.20.0 255.255.255.0"
push "route 10.240.5.0 255.255.255.0"
persist-key
persist-tun
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
status /var/log/openvpn/openvpn-status.log
log /var/log/openvpn/server.log
verb 4
route 172.19.20.0 255.255.255.0
Has anyone experienced this routing problem to/from EC2? I have used this configuration or similar for years without issue but cannot get it to work in AWS. Can anyone offer some advice?
Mike
