OpenVPN: OpenVPN Access Server set up and AWS VPC peering configuration
Tags: aws, amazonwebservices, networking, openvpn
Published: 2019-03-03 08:40:03

---
title: OpenVPN: OpenVPN Access Server set up and AWS VPC peering configuration
published: true
tags: aws,Amazon Web Services,Networking,OpenVPN
canonical_url: 
---


![](https://rtfm.co.ua/wp-content/uploads/2014/07/openvpn-logo-1.png)The _OpenVPN Access Server_ is ready to use OpenVPN server which requires minimal configuration.

The free version allows you to have two clients. If you need more – you can buy additional licenses.

### Infrastructure description

Currently to access our resources such as Jenkins, Nexus etc we are using Allow Rules in AWS Security Groups where each user has its own IP added.

This was not too bad approach while was a small team but as we are growing fast and there are more and more developers/QA – had to find a better solution.

In this post, we will set up an OpenVPN service using OpenVPN Access Server AWS AMI.

After all, everything will look like:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/openvnas-vpc.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/openvnas-vpc.png)

You can find documentation OpenVPN AS documentation [here>>>](https://openvpn.net/vpn-server-resources/amazon-web-services-ec2-tiered-appliance-quick-start-guide/) and some VPC peering example will be shown in this post.

### AWS: creating OpenVPN AS service

#### Running EC2

Find the AMI:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_141753.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_141753.png)

You can add license later so, for now, let’s use its _Free_ version.

Take a _t2.micro_ instance – it will be fair enough at this moment:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_141844.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_141844.png)

#### VPC

Create a new VPC for our VPN:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_141911.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_141911.png)

As we will use VPC peerings – make sure your networks aren’t overlapped.

In this case – I have Jenkins VPC with the _10.0.4.0/24_ CIDR and VPC VPN CIDR – _10.0.9.0/24_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_142535.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_142535.png)

Create a new subnet in this VPC:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_142639.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_142639.png)

Configure new EC2 networking using those VPC and subnet:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_142725.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_142725.png)

##### Internet Gateway

Create Internet Gateway (IGW) to access the Internet from your new VPC:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_143646.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_143646.png)

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_143710.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_143710.png)

Attach this IGW to your VPC:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_143744-1.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_143744-1.png)

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_143801.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_143801.png)

##### Route table

Next, have to update a _Route Table_ to be used to route traffic to the _0.0.0.0/0_ network (the Internet) via created IGW.

Go to your new subnet, find the _Route Table_ tab, click on it:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_164934.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_164934.png)

Add a new route via IGW:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_165044.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_165044.png)

#### Security Group

AWS will suggest you use a Security Group with an already predefined set of rules.

As this is such a Proof of Concept – you can leave it as is:

- TCP 22 — SSH access
- TCP 943 — OpenVPN AS admin UI access port
- TCP 443 — OpenVPN AS users UI access port
- UDP 1194 — OpenVPN UDP for VPN clients

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_142819.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_142819.png)

In kind of Production setup, you have to limit 943 and 22 by only trusted IPs.

Start the instance, create new RSA key for access:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_142936.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_142936.png)

#### Elastic IP

Create an EIP to use it with your new host:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_143444.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_143444.png)

Attach it:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_143509.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_143509.png)

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_143928.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_143928.png)

#### Source/Destination check disabling

For NAT’s correct work need to disable the _Source/Dest check_ (see post [AWS: миграция RTFM 2.5 — настройка NAT на Bastion EC2 как замена NAT Gateway](https://rtfm.co.ua/aws-migraciya-rtfm-2-5-nastrojka-nat-na-bastion-ec2-kak-zamena-nat-gateway/) и [AWS: миграция RTFM 2.7 — CloudFormation и Ansible — наcтройка NAT](https://rtfm.co.ua/aws-migraciya-rtfm-2-7-cloudformation-i-ansible-nactrojka-nat/)):

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_170508.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_170508.png)

And we are done with the EC2 now – let’s start configuring our new OpenVPN service.

### OpenVPN AS set up

SSH to the host using the _openvpnas_ login:

```
$ ssh -i dev-vpn-eu-west-1.pem openvpnas@52.18.110.226
```

Read :-) the license, accept it:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_165411.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_165411.png)

#### Initialization and the first configuration

On the first login, OpenVPN AS will start its wizard automatically.

You can run it later using the `ovpn-init`:

```
$ sudo ovpn-init --ec2
```

For now, you can just answer _Yes_ with default values for everything here:

1. Will this be the primary Access Server node? // yes
2. Please specify the network interface and IP address to be  
used by the Admin Web UI:  
(1) all interfaces: 0.0.0.0  
(2) eth0: 10.0.9.8  
// 2
3. Please specify the port number for the Admin Web UI.  
// yes – 943
4. Please specify the TCP port number for the OpenVPN Daemon  
// yes – 443
5. Should client traffic be routed by default through the VPN?  
// no – we will route only traffic to our own resources
6. Should client DNS traffic be routed by default through the VPN?  
// no
7. Use local authentication via internal DB?  
// yes
8. Private subnets detected: [‘10.0.9.0/24’]  
Should private subnets be accessible to clients by default?  
// yes
9. Do you wish to login to the Admin UI as “openvpn”?  
// yes
10. \> Please specify your OpenVPN-AS license key (or leave blank to specify later):  
// leave blank

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_170054.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_170054.png)

Set the `openvpn` user ‘s password:

```
$ openvpnas@openvpnas2:~$ sudo passwd openvpn
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
```

Now you can open your admin page using EIP created before – _https://52.18.110.226:943/admin_ in this case.

As we didn’t configure a hostnames/URLs – just agree here:

> Your connection is not private
> 
> Attackers might be trying to steal your information from  **52.18.110.226**  (for example, passwords, messages, or credit cards). Learn more
> 
> NET::ERR\_CERT\_AUTHORITY\_INVALID

(check the [OpenVPN: SSL and hostname configuration](https://rtfm.co.ua/en/openvpn-ssl-and-hostname-configuration/) post - it was added later)

Login to the admin page using the _openvpn_ user and password created with `passwd`:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_171015.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_171015.png)

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_171033.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_171033.png)

#### VPN client connection

Go to the user’s UI (no `/admin` at the end) – _https://52.18.110.226:943/?src=connect_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_171743.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_171743.png)

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_171814.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_171814.png)

Click on the _Yourself (user-locked profile)_ and download the `client.ovpn` file with settings for your local VPN client:

```
$ cat ~/.openvpn/client.ovpn
Automatically generated OpenVPN client config file
Generated on Wed Feb 20 15:19:38 2019 by openvpnas2
Default Cipher
cipher AES-256-CBC
Note: this config file contains inline private keys
and therefore should be kept confidential!
Note: this configuration is user-locked to the username below
OVPN\_ACCESS\_SERVER\_USERNAME=openvpn
...
```

Install the `openvpn` package on your local PC, here is Arch Linux used:

```
$ sudo pacman -S openvpn
```

Start it with the `--auth-user-pass` option:

```
$ sudo openvpn --config ~/.openvpn/client.ovpn --auth-user-pass
Wed Feb 20 17:22:42 2019 OpenVPN 2.4.6 x86\_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2018
Wed Feb 20 17:22:42 2019 library versions: OpenSSL 1.1.1a  20 Nov 2018, LZO 2.10
Enter Auth Username: openvpn
Enter Auth Password: \*\*\*\*\*\*\*
...
Wed Feb 20 17:22:51 2019 ROUTE\_GATEWAY 172.16.64.1/255.255.252.0 IFACE=wlp2s0 HWADDR=10:f0:05:64:0a:73
Wed Feb 20 17:22:51 2019 TUN/TAP device tun0 opened
Wed Feb 20 17:22:51 2019 TUN/TAP TX queue length set to 100
Wed Feb 20 17:22:51 2019 do\_ifconfig, tt-\>did\_ifconfig\_ipv6\_setup=0
Wed Feb 20 17:22:51 2019 /usr/bin/ip link set dev tun0 up mtu 1500
Wed Feb 20 17:22:51 2019 /usr/bin/ip addr add dev tun0 172.27.232.3/21 broadcast 172.27.239.255
Wed Feb 20 17:22:56 2019 ROUTE remote\_host is NOT LOCAL
Wed Feb 20 17:22:56 2019 /usr/bin/ip route add 52.18.110.226/32 via 172.16.64.1
Wed Feb 20 17:22:56 2019 /usr/bin/ip route add 10.0.9.0/24 metric 101 via 172.27.232.1
Wed Feb 20 17:22:56 2019 /usr/bin/ip route add 172.27.224.0/20 metric 101 via 172.27.232.1
Wed Feb 20 17:22:56 2019 Initialization Sequence Completed
```

Now – let’s check some routing.

First, let’s make a request to the CloudFlare – it must be passed via my office’s router/gateway:

```
$ traceroute 1.1.1.1
traceroute to 1.1.1.1 (1.1.1.1), 30 hops max, 60 byte packets
1  \_gateway (172.16.64.1)  3.109 ms  3.213 ms  3.428 ms
2  ru-german.relc.com (194.183.169.25)  4.771 ms  5.148 ms  6.039 ms
3  \* \* \*
4  ex4.thinx.pl (212.91.2.13)  16.468 ms  16.778 ms  17.277 ms
5  cloudflare.thinx.pl (212.91.0.28)  23.842 ms  24.154 ms  24.386 ms
6  one.one.one.one (1.1.1.1)  17.787 ms  15.023 ms  15.199 ms
```

Yup, it is.

And now to the OpenVPN host – must go directly:

```
$ traceroute 10.0.9.8
traceroute to 10.0.9.8 (10.0.9.8), 30 hops max, 60 byte packets
1  10.0.9.8 (10.0.9.8)  52.095 ms  52.149 ms  53.512 ms
```

Nice.

#### VPN-tunnel traffic routing

For the testing purposes – let’s add a new EC2 in the same VPC where is our OpenVPN placed:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_174010.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_174010.png)

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_174106.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_174106.png)

And let’s check routes again.

During local OpenVPN client start you have to notice a message with new routes to be added in your system:

> Wed Feb 20 17:22:56 2019 /usr/bin/ip route add 172.27.224.0/20 metric 101 via 172.27.232.1

Check it – try SSH using Private IP of the new instance:

```
$ ssh -i dev-vpn-eu-west-1.pem ubuntu@10.0.9.6
The authenticity of host '10.0.9.6 (10.0.9.6)' can't be established.
ECDSA key fingerprint is SHA256:6ldjTtHvQJviBb/9aXwFvwh7nwKjOdpePCxO6TddAJA.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.0.9.6' (ECDSA) to the list of known hosts.
Welcome to Ubuntu 18.04.1 LTS (GNU/Linux 4.15.0-1021-aws x86\_64)
...
ubuntu@ip-10-0-9-6:~$
```

All good.

### VPC peering

The next step is to configure VPC-peering and a traffic routing between our workstation, VPN-server, and the Jenkin’s VPC.

Read more about VPC-peering [here>>>](https://rtfm.co.ua/aws-nastrojka-vpc-peering/),

Create a new _VPC peering connection_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_174420.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_174420.png)

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_174441.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_174441.png)

Accept its request:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_174605.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_174605.png)

#### VPC-peering routing

If you’ll try to connect to the Jenkins using its Private IP – this will not work now:

```
ubuntu@ip-10-0-9-6:~$ ssh admin@10.0.4.13
ssh: connect to host 10.0.4.13 port 22: Connection timed out
```

Because there are no routes added between the _10.0.9.0/24_ (OpenVPN VPC) and the _10.0.4.0/24_ (Jenkins VPC) networks.

So now we have to add two new routes:

1. in the Jenkins route table – _10.0.4.0/28 => 10.0.9.0/24_ via VPC peering created above
2. in the OpenVPN route table – _10.0.4.0/28 => 10.0.9.0/24_ via VPC peering created above

Edit the _jenkins rtb-9597e6ec | jenkins-dev-route-table_ table:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_175149.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_175149.png)

Add the new route:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_175241.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_175241.png)

Repeat for the VPN’s route table:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_175335.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_175335.png)

Check from the VPN network:

```
ubuntu@ip-10-0-9-6:~$ ping 10.0.4.13
PING 10.0.4.13 (10.0.4.13) 56(84) bytes of data.
64 bytes from 10.0.4.13: icmp\_seq=1 ttl=64 time=0.470 ms
64 bytes from 10.0.4.13: icmp\_seq=2 ttl=64 time=0.483 ms
```

And from the Jenkins host – back to the VPN’s network to any host:

```
admin@jenkins-dev:~$ ping 10.0.9.6
PING 10.0.9.6 (10.0.9.6) 56(84) bytes of data.
64 bytes from 10.0.9.6: icmp\_seq=1 ttl=64 time=0.437 ms
64 bytes from 10.0.9.6: icmp\_seq=2 ttl=64 time=0.914 ms
```

Remember that Jenkins has its own _Security Group_ – add new Allow rule there.

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_180338.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_180338.png)

Check SSH from the VPN’s network:

```
ubuntu@ip-10-0-9-6:~$ ssh admin@10.0.4.13
The authenticity of host '10.0.4.13 (10.0.4.13)' can't be established.
ECDSA key fingerprint is SHA256:+0LP1+neT4udq96jFLdLpjuvTrWCzlAt5GZZpfw2rKI.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.0.4.13' (ECDSA) to the list of known hosts.
admin@10.0.4.13: Permission denied (publickey).
```

And back:

```
admin@jenkins-dev:~$ ssh 10.0.9.6
The authenticity of host '10.0.9.6 (10.0.9.6)' can't be established.
ECDSA key fingerprint is SHA256:6ldjTtHvQJviBb/9aXwFvwh7nwKjOdpePCxO6TddAJA.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.0.9.6' (ECDSA) to the list of known hosts.
Permission denied (publickey).
```

Good.

#### VPN routes

Go back to your workstation and check how traffic will be routed to the Jenkins host, using its Private IP:

```
$ traceroute 10.0.4.13
traceroute to 10.0.4.13 (10.0.4.13), 30 hops max, 60 byte packets
1  \_gateway (172.16.64.1)  3.243 ms  3.453 ms  3.656 ms
2  ru-german.relc.com (194.183.169.25)  3.962 ms  4.221 ms  4.642 ms
...
```

It is passed through the office’s router – and this is absolutely not what we want.

Go to the _VPN admin =\> VPN Settings_ – _https://52.18.110.226:943/admin/vpn\_settings_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_182317.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_182317.png)

Add a new NAT-rule for the _10.0.4.0/24_ subnet:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_182349.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_182349.png)

Save, press _Update Running Server_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_182501.png "AWS: настройка OpenVPN Access Server и VPC peerings")](https://rtfm.co.ua/wp-content/uploads/2019/02/Screenshot_20190220_182501.png)

Restart local client:

```
$ sudo openvpn --config ~/.openvpn/client.ovpn --auth-user-pass
...
Wed Feb 20 18:25:37 2019 ROUTE remote\_host is NOT LOCAL
Wed Feb 20 18:25:37 2019 /usr/bin/ip route add 52.18.110.226/32 via 172.16.64.1
Wed Feb 20 18:25:37 2019 /usr/bin/ip route add 10.0.4.0/24 metric 101 via 172.27.232.1
Wed Feb 20 18:25:37 2019 /usr/bin/ip route add 10.0.9.0/24 metric 101 via 172.27.232.1
Wed Feb 20 18:25:37 2019 /usr/bin/ip route add 172.27.224.0/20 metric 101 via 172.27.232.1
Wed Feb 20 18:25:37 2019 Initialization Sequence Completed
```

Here is our new route – _10.0.4.0/24 metric 101 via 172.27.232.1_.

Check your local routing table:

```
18:26:28 [setevoy@setevoy-arch-work ~]  $ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.16.64.1     0.0.0.0         UG    303    0        0 wlp2s0
10.0.4.0        172.27.232.1    255.255.255.0   UG    101    0        0 tun0
10.0.9.0        172.27.232.1    255.255.255.0   UG    101    0        0 tun0
52.18.110.226   172.16.64.1     255.255.255.255 UGH   0      0        0 wlp2s0
```

Check trace again:

```
$ traceroute 10.0.4.13
traceroute to 10.0.4.13 (10.0.4.13), 30 hops max, 60 byte packets
1  172.27.232.1 (172.27.232.1)  55.090 ms  55.207 ms  55.399 ms
...
```

Now it went via OpenVPN IP as a gateway.

Check if SSH works via Private IP:

```
18:27:41 [setevoy@setevoy-arch-work ~]  $ ssh -i jenkins-dev-eu-west-1.pem admin@10.0.4.13
...
admin@jenkins-dev:~$
```

_“It works!”_ (c) :-)

### DNS

The last thing to think about is the DNS settings.

As our Jenkins has to be accessible using its Public IP and domain _dev.ci.example.com_ from a few addresses on the Internet and via its Private IP – using VPN connection – need to find a way resolve it to a different IPs.

Check the [OpenVPN: DNS and dnsmasq configuration](https://rtfm.co.ua/en/openvpn-dns-and-dnsmasq-configuration/ "Permalink to OpenVPN: DNS and dnsmasq configuration") post for details.

Done.

### Similar posts

- <small>02/21/2019</small> [OpenVPN: настройка OpenVPN Access Server и AWS VPC peering](https://rtfm.co.ua/openvpn-nastrojka-openvpn-access-server-i-aws-vpc-peering/)<small> (0)</small>  
- <small>02/22/2019</small> [OpenVPN: DNS and dnsmasq configuration](https://rtfm.co.ua/en/openvpn-dns-and-dnsmasq-configuration/)<small> (0)</small>  
- <small>03/02/2019</small> [Arch Linux: OpenVPN – resolv.conf is not updated](https://rtfm.co.ua/en/arch-linux-openvpn-resolv-conf-not-updated/)<small> (0)</small>  
- <small>02/22/2019</small> [OpenVPN: настройки DNS и dnsmasq](https://rtfm.co.ua/openvpn-nastrojki-dns-i-dnsmasq/)<small> (0)</small>  
- <small>03/02/2019</small> [Arch Linux: OpenVPN – не обновляется resolv.conf](https://rtfm.co.ua/arch-linux-openvpn-ne-obnovlyaetsya-resolv-conf/)<small> (0)</small>