I'm trying to setup an OpenVPN server with Pritunl on AWS, and I'm having trouble getting my AWS nodes to connect to nodes outside the VPC through the VPN.
Basically my setup is
[ AWS Instance ] -- [ AWS OpenVpn Instance ] -- [ Local OS X Machine ]
Currently, traffic originating from the OS X machine works fine. I can ping any instance behind the VPC. However when I try to ping the Local OS X machine (or more accurately access a server running on that machine), the connection hangs.
The AWS nodes are in the 172.31.0.0/16 subnet, and the OS X machine is in the 192.168.241.0/24 subnet. On the OpenVpn Instance machine, ping works normally:
ubuntu@ip-172-31-11-153:~$ ping 192.168.241.2
PING 192.168.241.2 (192.168.241.2) 56(84) bytes of data.
64 bytes from 192.168.241.2: icmp_seq=1 ttl=64 time=186 ms
64 bytes from 192.168.241.2: icmp_seq=2 ttl=64 time=170 ms
On the AWS instance, ping hangs:
ubuntu@ip-172-31-32-5:~$ ping 192.168.241.2
PING 192.168.241.2 (192.168.241.2) 56(84) bytes of data.
^C
--- 192.168.241.2 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2015ms
On the OpenVPN machine, using tcpdump, I can see the packets make it to the machine, however a reply is never sent
ubuntu@ip-172-31-11-153:~$ sudo tcpdump -i any -n icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
02:04:32.706204 IP 172.31.32.5 > 192.168.241.2: ICMP echo request, id 31959, seq 1, length 64
02:04:33.705490 IP 172.31.32.5 > 192.168.241.2: ICMP echo request, id 31959, seq 2, length 64
02:04:34.705519 IP 172.31.32.5 > 192.168.241.2: ICMP echo request, id 31959, seq 3, length 64
02:04:35.705436 IP 172.31.32.5 > 192.168.241.2: ICMP echo request, id 31959, seq 4, length 64
For comparison, this is what happens when the OpenVPN machine pings the local OS X machine
ubuntu@ip-172-31-11-153:~$ sudo tcpdump -i any -n icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
02:06:13.214559 IP 192.168.241.1 > 192.168.241.2: ICMP echo request, id 4169, seq 1, length 64
02:06:13.791529 IP 192.168.241.2 > 192.168.241.1: ICMP echo reply, id 4169, seq 1, length 64
02:06:14.215124 IP 192.168.241.1 > 192.168.241.2: ICMP echo request, id 4169, seq 2, length 64
02:06:14.370423 IP 192.168.241.2 > 192.168.241.1: ICMP echo reply, id 4169, seq 2, length 64
The Route Table in the AWS console is configured (192.168.241.0/24 -> OpenVpn Instance)
The OpenVPN instance has IP forwarding enabled (echo 1 > /proc/sys/net/ipv4/ip_forward)
Source/Dest check on the OpenVPN instance is disabled.
I've tried ip route add (11.153 is the openvpn instance), and it just returns an error:
ubuntu@ip-172-31-32-5:~$ sudo ip route add 192.168.241.0/24 via 172.31.11.153
RTNETLINK answers: Network is unreachable
My IP Tables are defined like so:
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere ip-172-31-0-0.us-east-2.compute.internal/16 /* pritunl-5a1f3acaf55623048c5ccaf0 */
ACCEPT all -- anywhere ip-192-168-241-0.us-east-2.compute.internal/24 /* pritunl-5a1f3acaf55623048c5ccaf0 */
DROP all -- anywhere anywhere /* pritunl-5a1f3acaf55623048c5ccaf0 */
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- ip-172-31-0-0.us-east-2.compute.internal/16 anywhere ctstate RELATED,ESTABLISHED /* pritunl-5a1f3acaf55623048c5ccaf0 */
ACCEPT all -- anywhere ip-172-31-0-0.us-east-2.compute.internal/16 /* pritunl-5a1f3acaf55623048c5ccaf0 */
ACCEPT all -- ip-192-168-241-0.us-east-2.compute.internal/24 anywhere /* pritunl-5a1f3acaf55623048c5ccaf0 */
ACCEPT all -- anywhere ip-192-168-241-0.us-east-2.compute.internal/24 /* pritunl-5a1f3acaf55623048c5ccaf0 */
DROP all -- anywhere anywhere /* pritunl-5a1f3acaf55623048c5ccaf0 */
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- ip-172-31-0-0.us-east-2.compute.internal/16 anywhere /* pritunl-5a1f3acaf55623048c5ccaf0 */
ACCEPT all -- ip-192-168-241-0.us-east-2.compute.internal/24 anywhere /* pritunl-5a1f3acaf55623048c5ccaf0 */
DROP all -- anywhere anywhere /* pritunl-5a1f3acaf55623048c5ccaf0 */
