TCP Disconnects immediately via VPN

omry

I have a very strange problem and I can use some help:
I have two subnets behind my openvpn server :
10.0.0.0/24 and 10.0.1.0/24
A external VPN client can pings and gets replies from machines inside each subnet. also - machines can ping client.
when I open a TCP connection from the VPN client to any TCP Server in the second subnet, the connection opens but gets closed as soon as I try to send something.
To make things stranger - machines in the second subnet can communicate with TCP servers on the client without problems.

For the record : everything is on amazon ec2. the two subnets are inside a VPC (Virtual private cloud). the "public subnet" works and the "private subnet" got the issue.

Update:
using netcat, I established that the server receives the data sent by the client, and the connection is terminated immediately afterwards:

Client:

root@client:~# echo hello | nc -t  web1 8000

Server:

root@web1:~# nc -l -p 8000
hello
root@web1:~#

any idea what it could be?

Update 2:

ROUTER:

    # ip route show
    10.0.0.0/24 dev eth0  proto kernel  scope link  src 10.0.0.115
    10.8.0.0/24 via 10.0.0.100 dev eth0
    default via 10.0.0.1 dev eth0

CLIENT:

    root@ip-10-0-1-70:/etc/openvpn# grep -v "^$\|#\|;" /etc/openvpn/client.conf
    client
    route 10.0.0.0 255.255.255.0
    route 10.0.1.0 255.255.255.0
    script-security 2
    dev tun
    proto udp
    remote 184.72.117.227 1194
    resolv-retry infinite
    nobind
    persist-key
    persist-tun
    ca ca.crt
    cert client.crt
    key client.key
    ns-cert-type server
    verb 3
     
     
    root@ip-10-0-1-70:/etc/openvpn# ip route show
    10.8.0.5 dev tun0  proto kernel  scope link  src 10.8.0.6
    10.8.0.1 via 10.8.0.5 dev tun0
    10.40.65.0/24 dev eth0  proto kernel  scope link  src 10.40.65.131
    10.0.0.0/16 via 10.8.0.5 dev tun0
    default via 10.40.65.1 dev eth0

Server:

    root@mgm:/etc/network# grep -v "^$\|#\|;" /etc/openvpn/server.conf
    port 1194
    proto udp
    dev tun
    ca ca.crt
    cert server.crt
    dh dh1024.pem
    server 10.8.0.0 255.255.255.0
    duplicate-cn
    keepalive 10 120
    persist-key
    persist-tun
    status openvpn-status.log
    verb 3
     
     
    root@mgm:/etc/network# ip route show
    10.8.0.2 dev tun0  proto kernel  scope link  src 10.8.0.1
    10.0.0.0/24 dev eth0  proto kernel  scope link  src 10.0.0.100
    10.8.0.0/24 via 10.8.0.2 dev tun0
    169.254.0.0/16 dev eth0  scope link
    default via 10.0.0.1 dev eth0

Mimiko

What is the "TCP Server"? Never heard of something like this. May be you have a service that is leastening on some TCP port?

The question is more for amazon's. If ping is working, then the VPN is working good. May be the server that must respond is configured not ot respond to IPs from the VPN tunnel pool. Check the firewall on that server.

janjust

I'm not sure what the default behaviour of 'nc' is in terms of hanging up after the client hangs up - can you try running something else, e.g. iperf ?

another trick is to run a (mini) webserver and then use curl/wget on the client side to see if you can establish a connection.

Finally, it could also be an MTU issue : try adding 'fragment 1300' to both client and server to see if it makes a difference (but this is for debugging purposes only).