Q:

AWS EC2 and OpenVPN

I've been trying for a few hours to get OpenVPN working with AWS EC2 without any luck. Its the same setup as anyone would think of: Openvpn running on a server to gain access to resources within the VPC (private address space).
I've turned off "check source / dest" address on ALL instances, without luck.
VPN: 10.9.0.0/16
VPC: 172.16.0.0/16
I can connect to the VPN fine and ping 10.9.0.x fine. Can also ping the private address on the same box as the VPN. The two boxes can ping each other (private or public) just fine. 
The problem's with AWS. Can I do NAT on this somehow so it thinks the packet is originating from the private address space? 
[root - openvpn]# tcpdump -i any -n icmp
01:15:00.571096 IP 10.9.0.6 > 172.31.88.99: ICMP echo request, id 56638, seq 16, length 64
01:15:00.571125 IP 10.9.0.1 > 10.9.0.6: ICMP host 172.31.88.99 unreachable - admin prohibited, length 92

A:

There are a few steps you need to do.
On the openvpn server you have to make sure ip forwarding is on
echo 1 > /proc/sys/net/ipv4/ip_forward

You shouldn't need any fancy NAT or MASQ rules for openvpn if you want the destination host to see the VPN IP (which you should in my opinion)
On the AWS side you need to make sure your route tables are setup to route the VPN CIDR (10.9.0.0/16) back to the openvpn server. 

