I'm trying to build an OpenVPN gateway **from** my **VPC** -> **into** the **office** network. I've successfully set up a VPN client on one of my EC2 instances (let's name it "gateway") and now it has VPN virtual interface "tun0".

Now I want to route all office-related traffic (dst 172.20.0.0/16) from the rest of EC2 instances in the VPC to "gateway"'s network interface (10.0.0.100).

I've tried 2 different approaches:

* add a new rule into the related AWS Route Table: 172.20.0.0/16 -> eni-XXX (where eni-XXX is an id of "gateway"'s interface);
* update EC2's route table: route add -net 172.20.0.0 netmask 255.255.0.0 gw 10.0.0.100

Both variants seem to be failed because running "tcpdump -i eth0 'src port not 22 and dst port not 22'" on the gateway and curling/pinging internal office ips shows nothing :(

Does anyone have an idea about what's wrong? Or may be has a batter solution for my problem? 

And the second question. Once I get my traffic on gateway's eth0, I plan to forward it into the VPN connection using the following IpTables commands:

```
iptables -t nat -A POSTROUTING -o tun0  -j MASQUERADE
iptables -A FORWARD -i eth0 -s 10.0.0.0/16 -o tun0 -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

```

Should I expect any problems here (except enabling ip forwarding)?