Route all traffic (redirect-gateway) not working - OpenVPN

Question

First of all, I know this question has been asked at least a million times. I have tried many solutions and still can't get my VPN to work. When I connect to my VPN my client IP changes to the VPN IP (expected). But won't route all traffic through the VPN. I can tell because I use OpenDNS as my home DNS server and use their internetbadguys.com test domain to test traffic through the VPN. I am using the push flags in server.conf:

push "redirect-gateway def1"
push "remote-gateway vpn_server_ip"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 60

and in client.ovpn:

push "redirect-gateway def1"

Also, if it helps, I am using an AWS EC2 instance to run my VPN. I'm not sure what else to do next. Hopefully, someone can figure this out :)

Thanks in advance!

Server and Client configs below:

Server:

port PORT
proto udp
dev tun
ca ca.cert
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 172.31.0.0 255.255.0.0"
keepalive 10 120
tls-auth ta.key 0
key-direction 0
cipher AES-128-CBC
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
# ROUTE CLIENT'S INTERNET ACCESS THROUGH THE SERVER
push "redirect-gateway def1"
push "remote-gateway vpn_server_ip"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 60

crl-verify crl.pem

Client:

client
dev tun
proto udp
remote MY-SERVER-IP PORT
remote MY-SERVER-HOSTNAME PORT
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
remote-cert-tls server
comp-lzo
push "redirect-gateway def1"
verb 3

Answer 1

For anyone else with this problem, you most likely need to enable IP forwarding on the server as that will probably be off by default.

Put this in /etc/sysctl.conf:

net.ipv4.ip_forward = 1

And then run:

sysctl -p /etc/sysctl.conf

Now that takes care of your IP forwarding. If you're running a firewall (perhaps iptables) then you're probably going to want to get your NAT going so run this:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Put something like this into /etc/sysconfig/iptables to make it permanent:

*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT

All going well your server is now forwarding your client VPN traffic. The next thing you're going to want to do is head your client browser over to whatismyipaddress.com to see that it's showing an Amazon address and then onto www.dnsleaktest.com and see how things are looking. If you're leaking out through Google you may want to consider running up a simple DNS caching server on your VPN server and point your client at that if anonymity is desired.

I hope that helps.