Multi tool use

how to share VPN connection to instances in private subnet?

I created 2 instances:

I followed this guide and could make it work. VM-B can access internet (via VM-A): https://aws.amazon.com/premiumsupport/knowledge-center/vpc-nat-instance/

On VM-A I've setup OpenVPN and it can connect to our VPN server in our office.

Now I would like VM-B to be able to use the VPN connection of VM-A to access machines in our office but I can't find a way how to do it.

I think I know why it is not working, because in the route table of VM-B I have:

Destination Target
10.0.0.0/16 local
0.0.0.0/0 eni-xxxx


The network interface eni-xxxx belongs to VM-A. So the traffic is going there.

Instead I would like to add something like this but it seems not possible because "tun0" is not a valid resource ID:

Destination
10.100.7.2 (network in our office accessible via VPN)

Target
tun0 (the network interface created by OpenVpn)


Any advice on how to solve this issue?

Extra question:
Is it a good practice to add routes using the "route add" command or is it better to use the Web interface "Route Tables" in the VPC dashboard?

1 Answer
1

I found the solution. I was missing a rule in the firewall to masquerade the address.
On VM-A:

# the subnet of VM-B is 10.0.30.0/24
$ sudo iptables -t nat -A POSTROUTING -o tun0 -s 10.0.30.0/24 -j MASQUERADE


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.