I am trying to set up an OpenVPN server on Ubuntu 18.04 in AWS in routed mode, using a tun interface (not tap). The server sits in a public subnet, with an attached ENI in a private subnet.

All is working well in terms of the OpenVPN set up as it is possible to connect and then to connect to resources on the AWS side of the tunnel.

We need to be able to route all internet bound traffic from vpn clients (coming in on the tun0 interface) out of the server's public interface and to our NAT gateway. This route needs to exclude the whole as a destination, so we need to do some policy routing. Basically, all private traffic needs to route internally and everything else, via the NAT Gateway. The server has the following NICs:

ens5 - Public subnet

ens6 - Private Subnet

tun0 - OpenVPN interface

As I understand it, I need to be able to apply the routing to the tun0 interface, but the tun0 interfaces doesn't exist until I have started the openvpn service

Another problem is that netplan doesn't seem to cater for tun (or tap for that matter) interfaces natively and I can't seem to find any examples for what I am trying to do. Annoyingly, this page provides an example for a Layer2 VPN, but not a Layer3 (routed) VPN.

So, does anyone have an idea of how to policy route traffic coming from a tun0 interface?

Any help is greatly appreciated!!!

P.S. I get the impression NetPlan is a bit immature to be in a LTS release of Ubuntu!

  • Partially answered, but I'm unclear why you need policy routes at all. Excluding a network as a destination from the default route seems like a standard entry in a route table, not a policy route. Can you explain where you want traffic for to be sent, and why this is different based on whether the originating traffic comes from the OpenVPN tunnel vs. elsewhere? – slangasek Feb 6 '19 at 19:00
  • Adding any logic into routing makes it policy based. The main reason behind this is that in AWS there are so many different gateways for different types of traffic. So we have one gateway to route internal traffic to, one for VPN traffic and one for Internet based traffic. Quite why they do it this way, I do not know – Taff Feb 7 '19 at 12:39

Your tun interface in this case is managed by OpenVPN, not by netplan. You should manage any routes (including policy routes) for this interface through the OpenVPN configuration, and not try to mix management of it through both OpenVPN and netplan.

As of netplan 0.95, there is support for managing tunnel interfaces, but it is still not recommended to use netplan for an OpenVPN-managed interface.

| improve this answer | |
  • Hi slangasek, Ok thanks for the response, and that seems reasonable. I suppose what I was looking for was a way of adding a policy route globally rather than by interface. Such functionality is definitely useful to have. Looking forward to using v1.0 of NetPlan!!! – Taff Feb 7 '19 at 12:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.