AWS Pfsense OpenVPN no access to private subnet - amazon-web-services

My question is about not being able to connect to my private instance in AWS VPC through a VPN.
I have set up a pfsense instance that also acts as the OpenVPN server.
Then I installed pfsense on AWS with the official pfsense AMI and everything is working as expected so far.
I have 1 public subnet and 1 private subnet containing a linux instance that I want to reach via the VPN.
When connecting to the VPN I can't ping the linux instance in the private subnet.
The pfsense firewall (2.4.4) has the following interfaces:
**WAN** 10.3.0.245
**LAN** 10.3.1.5
The OpenVPN tunnel network is 10.3.2.0/24 going to 10.3.1.0/24 channeling all trafic trough the VPN.
The linux instance has the following private IP: 10.3.1.58
The firewall itself can ping the instance and when I connect to the VPN (windows host) I can ping the firewall on 10.3.1.5 .
However, I can't ping 10.3.1.58 (request timed out).
I cant SSH either into the instance.
Could the route table be wrong?
Route print on windows vpn client:
The security group in amazon allows all trafic for now.
Disabled the firewall on the linux system.
Disabled source / destination checking on the instance and the secondary network interface.
I have allowed traffic from the vpn to the lan (for now I allowed all traffic to see where the problem lies).

Did you disable source/destination checks on the pfsense instance?
You can disable it by following this guide - https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck

My hosts have their gateway set as 10.3.1.1, it should be 10.3.1.5 (PFSense Lan).

Related

Can't access the EC2 instance remotely

I'm trying to connect my friend's MySQL database remotely but I'm getting connection timeout error. I tried to ssh. But same result.
Then I check that instance. It has public IP. Also allowed 3306 and 22 ports on the security group. Allowed 100th rule for all sources in subnet NACL.
What I'm missing? Is there any other way to block those traffic? Can anyone help me? I'm a still beginner
When an SSH connection times-out, it is normally an indication that network traffic is not getting to the Amazon EC2 instance.
Things to check:
The instance is running Linux
The instance is launched in a public subnet, which is defined as having a Route Table entry to points to an Internet Gateway
The instance has a public IP address, which you are using for the connection
The Network Access Control Lists (NACLs) are set to their default "Allow All" values
A Security Group associated with the instance that permits inbound access on port 22 (SSH) either from your IP address, or from the Internet (0.0.0.0/0)
Your corporate network permits an outbound SSH connection (try alternate networks, eg home vs work vs tethered to your phone)
See also: Troubleshooting connecting to your instance - Amazon Elastic Compute Cloud
Based on your descriptions, I would suggest checking whether the instance was launched in a public subnet.
I found the reason. That instance was deployed in a private subnet and didn't have inbound access.
Solution:-
I deployed a bastion host in a public subnet and used SSH agent forwarding to access the instance through the bastion host.

AWS OpenVPN instance can't ssh to other ec2 instances of connect to web

I set up an OpenVPN EC2 instance on AWS and it has security groups like
I downloaded the client.ovpn file and can successfully connect to it like sudo openvpn --config client.ovpn in Ubuntu (and also via Network Manager after importing the config). All good.
Now I want to make it so my other EC2 instances (that host the actual app) can only be accessed via the VPN, and can't be SSH'd into directly for example. The security group of one of these EC2 instances looks like
where here I'm allowing inbound traffic on port 22 from the Private IPv4 addresses of the OVPN server.
However, if I connect to the VPN and try to SSH to the app EC2 instance it just times out, nor can I access the web when connected to the VPN.
If I allow SSH on port 22 from 0.0.0.0 then I can SSH in and no issues.
Could anyone point me toward what the problem might be?
Could it be because they are on different subnets?
The simple solution: Forward all traffic through OpenVPN. Restrict and connect to your instances with OpenVPN's public IP, connect to your EC2s through their public IPs
The reason why your solution did not work as I understand it
AWS VPC is kind of like a VPN already
You are trying to connect to your EC2 through their public IP which routes through the internet so it makes litte sense allowing OpenVPN's private IP as to talk with EC2's public IP the server that you are installing OpenVPN shall use their public IP
If you must use OpenVPN and does not want the internal (OpenVPN to EC2) connections to surface to the internet, the EC2 instances must join OpenVPN's private network, there, everyone can talk using the private IPs of OpenVPN's range
Or extend AWS VPC with OpenVPN
Or see if split-tunnel work which "May allow users to access their LAN devices while connected to VPN"

HashiCorp Vault is not accessible out side of EC2

I have installed HashiCorp vault in a Linux EC2 machine in AWS. I have unsealed it and allowed all the outbound traffic in Security Group. I am able to access the Vault service within EC2 instance using "http://localhost:8200". But I am unable to use the service when I try to hit the URL using public IPV4 of the EC2 from internet (ex: http://xxx.xxx.xxx.xxx:8200).
Check your network configurations.
There are a few things you can check:
Your Security Group allow connections from your IP to the port 8200
Your EC2 instance is in a public subnet.
The NACL of public subnet allows connections to/from the port 8200 and to/from your IP.
The Route Table of public subnet has attached an Internet Gateway.
If you validate this 4 points and still can't connect with the service, it can be a problem of the service listen-address is 127.0.0.1 (localhost).
https://www.vaultproject.io/docs/commands/server.html#dev-listen-address
In that case, you should start your HashiCorp Vault with the options:
-dev -dev-listen-address="0.0.0.0:8200"
This problem is described here:
Is it possible to start Vault dev server on 0.0.0.0 instead of 127.0.0.1?

Accessing WebApplication exposed by EC2 instance in Private Subnet

We have a web-application page exposed at port 9090 on an EC2 instance that lives in the private subnet of our AWS setup.
We have a bastion host that is in the public subnet, and it can talk to the instance in the private subnet. We can also ssh to the instance thru the ssh tunnel of the bastion.
Is there a guide to setting up a proxy on this bastion host to access the webpage in the browser that is served on the http://PrivateSubnetEC2Isntance:9090/, by redirecting the traffic to/from http://PublicBastion:9090/?
I tried setting up a HAProxy (on bastion), but it doesn't seem to work: there are no errors in the HAproxy logs, but accessing the page http://PublicBastion:9090 just times-out.
Though this is not an answer, most likely it could be due to:
Security group rules: Did you open port 9090 for everyone in Bastion security group?
Is your HAProxy listening on 0.0.0.0 and not on 127.0.0.1?

Run Filezilla Client in private subnet

I have a VPC with one public subnet and one private.
The public subnet has an OpenVpn Server (worked also as NAT) and a public IP
The private subnet has a Win 2012R2 Server with an Oracle 11g server.
My set up:
1. VPC:
2. Public Subnet:
3. Private Subnet:
4. Internet gateway
5. Security Groups:
5a: For the VPN server:
5b: For the Win Server (with the oracle server)
So, I've set up the OpenVPN server and I am able to connect to the server from my laptop. Everything is fine.
Now I want to run FileZilla in my Win Server to download some files from ftp sites.
I add more security groups to my Win Server with inbound and outbound rules but it doesn't work. I think that I have to add a route table for my private subnet to connect to outside world, but I have no idea how to implement that.
Rules that I have tried (inbound and outbound):
Route table that I tried:
Any ideas?
Can you open a browser on the Windows server and view Internet sites? I'd start by getting that working before moving on to FileZilla. If you truly have your OpenVPN server also working as a NAT server then it should be providing internet access for the instances in the private subnet. You shouldn't need to open any inbound rules in the security group (because you aren't running an FTP/SFTP server, just a client), and you should be able to leave the outbound rules as default (which allow all outbound traffic).
It appears that you are missing a route table entry for your NAT gateway, so your OpenVPN server is not currently acting as a NAT gateway. You will have to configure a NAT Instance or an AWS managed NAT Gateway in order to allow instances in your private subnet to access the Internet. You should read the documentation.
You will have to create a Bastion Server in your Public Subnet to make that File Zilla to work. Check below guide.
https://blogs.aws.amazon.com/security/post/Tx3N8GFK85UN1G6/Securely-connect-to-Linux-instances-running-in-a-private-Amazon-VPC