OpenVPN Access Server Routing Not Working - Could use some help:)

VPN
1

I am working on setting up VPN-based access to an AWS VPC, and things are not working. I would appreciate any advice or guidance:)

What I’m trying to do: Allow many GL-iNet routers to use their built-in OpenVPN Client functionality to connect to an OpenVPN Access Server running on an EC2 instance in an AWS VPC. LAN Clients (attached to the GL-iNet Routers) will need to access various resources within the VPC (RDS, EC2, DNS, etc…). And AWS VPC resources (EC2 instances, other VPN clients, etc…) need to be able to access a few specific things on two specific computers on the client LANs (ssh, RDC, HTTPS).

Current Plan/Approach:

VPC: 10.10.0.0/16 - broken up into various public and private subnets across 3 AZs (although only using things in AZ1 for now)

OpenVPN Access Server - running on EC2 instance in a public subnet in AZ1. Used the OpenVPN Access Server marketplace setup/AMI, so all networking etc… should be setup correctly. Confirmed that the ENI has Source/Dest Check set to false.

VPN client subnets - various subnets within 10.9.0.0/16 (10.9.0.0/23 for global level dynamically handed out IPs, 10.9.20/23 for global static IPs, 10.9.4.0/23 as the group default, and then further groups for various users and groups.

OpenVPN Access Server is configured with server side private subnet access set to “Yes, using Routing” with 10.10.0.0/16 as the private subnet that clients should be given access.

Added route for 10.9.0.0/16 -> VPN server’s ENI to all route tables.

SG for EC2 instance allows all traffic inbound from 10.9.0.0/16 and 10.10.0.0/16 (plus needed ports for OpenVPN server functionality open to the public).

Testing with both GL-iNet router and with a laptop directly connecting to the OpenVPN.

Connection to VPN server works fine. Can get out to the public internet over the VPN connection (routes out through the EC2 instance’s public IP). Can ping the private IP of the VPN server EC2 instance. Can access client side resources from the OpenVPN EC2 server via port forwarding rules in the GL-inet router. All that is good.

​

However, I am unable to access private VPC resources outside of the VPN server from the client side of the VPN. This includes RDS instances, the DNS server at 10.10.0.2, or the subnet gateway at 10.10.33.1. Based on tcpdump captures it looks like the packets are going out from the VPN server EC2 instance, but nothing comes back.

If I switch from “Yes, using Routing” to “Yes, using NAT” then I can access all those things just fine, but cannot access client side LAN resources from the VPC.

So it seems like the route telling the subnets/VPC that return traffic to 10.9.0.0/16 needs to go to the VPN EC2 instance isn’t working? Or the EC2 instance isn’t accepting that traffic?

I’ve been beating my head against this all day and am rushing towards a deadline, so any help would be appreciated! Thanks!

Route - https://p198.p4.n0.cdn.getcloudapp.com/items/yAuBP8dk/a64f75dd-e722-4716-837a-2cfcbc2db039.png?v=d4fe59c9a68f9587974242937c2a8db5

​

-------------

SOLVED (ish)

There’s some routing issue that happens when “route internet traffic through the VPN” is enabled. Disabling that option on the OpenVPN Server seems to solve my routing issue.

​

​

2

I used tailscale for the same purpose and it worked for me.

3

Have you disabled source/dest check on the NIC? This setting is on by default and means the host needs to be the source or destination of the packets. You can turn it off and I’d wager it might fix your issue.

4

Hello devondragon1, did you solve the problem? I had a similar problem, but I was based on Tencent Cloud. At present, can access the VPC subnet from the VPN client side subnet, but otherwise, it cannot be successfully accessed. the second problem is that the VPN client side subnet cannot connect to Tencent Cloud Private DNS.
Looking forward to your reply，thanks！

5

Yes! Interestingly enough, when I turn Off “route internet traffic through the VPN”, I am now able to connect to the RDS instance when in Routing mode! However I still cannot connect to the AWS DNS server at 10.10.0.2. I wonder if it will only respond to queries from the VPC CIDR…

6

Confirmed. Okay so there is some issue with Routing when I have route all internet traffic over the VPN enabled, but I don’t need that so that’s fine. I will figure out an alternative DNS solution.

7

I personally don’t route Internet through, only local VPC traffic, but definitely do use AWS DNS. Although, I use decided DNS with Route53.
I ended up using a completely separate VPC from my main VPC and routing everything via Transit Gateways, this was primarily because I have many Site-to-site VPNs configured as well. But I do believe I had to make sure the Subnet range I was using for client IPs was included in the VPC CIDR.