I'm setting up an openvpn server on an aws ec2 instance. This instance has two interfaces :
- One interface belonging to a private subnet (10.10.0.0/17)
- One interface belonging to a public subnet (10.10.128.0/17)
My goal is to allow traffic from the internet to communicate with the instances that are in the private subnet, through the VPN.
Here is a schema
The connection is well established between outside and the public interface. It is also established between the private interface and the instances that are in the private subnet.
The problem appears when i try to ping private instances from an outer client. I can see the "initialization sequence completed" message, but no traffic seems to be routed through the tunnel. Actually no route at all seems found, even when the destination is the vpn server itself :
traceroute to server tun interface
connexion logging on client
connexion logging on server
Even though there seems to be errors when the route is created, it is present in the kernel routing table so I guess the problem doesn't come from here :
route command on client
Here is my client configuration :
client
dev tun
proto udp
remote <server_ip> 1194
route 10.10.0.0 255.255.128.0
nobind
resolv-retry infinite
persist-key
persist-tun
comp-lzo
verb 3
cipher AES-256-CBC
<ca>
-----BEGIN CERTIFICATE-----
<SNIP>
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
<SNIP>
-----BEGIN CERTIFICATE-----
<SNIP>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<SNIP>
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
<SNIP>
-----END PRIVATE KEY-----
</key>
And the server one :
local 0.0.0.0
port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server.crt
key /etc/openvpn/easy-rsa/pki/private/server.key
dh /etc/openvpn/easy-rsa/pki/dh.pem
topology subnet
server 10.10.0.0 255.255.128.0
#client-to-client communication
duplicate-cn
keepalive 10 120
cipher AES-256-CBC
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
mute 10
explicit-exit-notify 1
I've followed the openvpn howto from begin to start and really don't know what I'm missing. Thanks in advance for your help !