I am trying to set up an OpenVPN server on Ubuntu 18.04 in AWS in routed mode, using a
tun interface (not
tap). The server sits in a public subnet, with an attached ENI in a private subnet.
All is working well in terms of the OpenVPN set up as it is possible to connect and then to connect to resources on the AWS side of the tunnel.
We need to be able to route all internet bound traffic from vpn clients (coming in on the
tun0 interface) out of the server's public interface and to our NAT gateway. This route needs to exclude the whole 10.0.0.0/8 as a destination, so we need to do some policy routing. Basically, all private traffic needs to route internally and everything else, via the NAT Gateway. The server has the following NICs:
ens5 - Public subnet
ens6 - Private Subnet
tun0 - OpenVPN interface
As I understand it, I need to be able to apply the routing to the tun0 interface, but the tun0 interfaces doesn't exist until I have started the openvpn service
Another problem is that netplan doesn't seem to cater for
tap for that matter) interfaces natively and I can't seem to find any examples for what I am trying to do. Annoyingly, this page provides an example for a Layer2 VPN, but not a Layer3 (routed) VPN.
So, does anyone have an idea of how to policy route traffic coming from a
Any help is greatly appreciated!!!
P.S. I get the impression NetPlan is a bit immature to be in a LTS release of Ubuntu!