VPN para o Windows Server 2012 em ec2 sem roteamento

Question

Eu tenho uma instância do Windows Server 2012 no EC2 para que eu possa VPN na rede privada para acessar máquinas não expostas através de um IP público.

Eu posso me conectar à VPN do Windows Server por seu IP público e autenticar corretamente. Eu recebo um endereço IP na rede privada.

O servidor não está roteando pacotes do cliente VPN para outras máquinas na rede privada no EC2.

O que estou fazendo de errado?

route print

===========================================================================
Interface List
  3...00 1c 42 72 46 c6 ......Intel(R) PRO/1000 MT Network Connection
 27...........................fhx
  1...........................Software Loopback Interface 1
  4...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
  5...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
  6...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      10.211.55.1      10.211.55.3   4235
          0.0.0.0          0.0.0.0         On-link     173.31.21.112     11
      10.211.55.0    255.255.255.0         On-link       10.211.55.3   4491
      10.211.55.3  255.255.255.255         On-link       10.211.55.3   4491
    10.211.55.255  255.255.255.255         On-link       10.211.55.3   4491
    [PUBLIC IP OF SERVER]  255.255.255.255      10.211.55.1      10.211.55.3   4236
        127.0.0.0        255.0.0.0         On-link         127.0.0.1   4531
        127.0.0.1  255.255.255.255         On-link         127.0.0.1   4531
  127.255.255.255  255.255.255.255         On-link         127.0.0.1   4531
    173.31.21.112  255.255.255.255         On-link     173.31.21.112    266
        224.0.0.0        240.0.0.0         On-link         127.0.0.1   4531
        224.0.0.0        240.0.0.0         On-link       10.211.55.3   4491
        224.0.0.0        240.0.0.0         On-link     173.31.21.112     11
  255.255.255.255  255.255.255.255         On-link         127.0.0.1   4531
  255.255.255.255  255.255.255.255         On-link       10.211.55.3   4491
  255.255.255.255  255.255.255.255         On-link     173.31.21.112    266
===========================================================================
Persistent Routes:
  None

ipconfig

Windows IP Configuration


Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : localdomain
   IPv6 Address. . . . . . . . . . . : fdb2:2c26:f4e4:0:693c:db02:9965:9279
   Link-local IPv6 Address . . . . . : fe80::693c:db02:9965:9279%3
   IPv4 Address. . . . . . . . . . . : 10.211.55.3
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 10.211.55.1

PPP adapter fhx:

   Connection-specific DNS Suffix  . :
   IPv4 Address. . . . . . . . . . . : 173.31.21.112
   Subnet Mask . . . . . . . . . . . : 255.255.255.255
   Default Gateway . . . . . . . . . : 0.0.0.0

Tunnel adapter isatap.localdomain:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : localdomain

Tunnel adapter isatap.{0ED5745E-7C2A-4543-A6E5-C426914B2CD4}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :