Configuring Oracle EBS Workflow Mailer with Zoho SMTP Using an Existing OpenVPN Server as a NAT Gateway
Published Sept. 6, 2026, 4:45 p.m. by cloudblog
This guide documents the network preparation performed to provide an Oracle E-Business Suite (EBS) server in a private OCI subnet with controlled outbound Internet connectivity, without deploying an OCI NAT Gateway.
The objective is to allow the EBS Workflow Notification Mailer to communicate with Zoho Mail, particularly:
SMTP: smtppro.zoho.in:465
SSL: Enabled
The existing OpenVPN Access Server is being reused as the Internet gateway/NAT device for the private EBS server.
1. Existing Network Architecture
The OCI environment contains a VCN:
VCN: vcn-appsolworldblog
The OpenVPN Access Server is deployed in one subnet, while the EBS server is deployed in another private subnet.
OpenVPN Server
Hostname: appsolworldvpn
Private IP: 10.0.0.33
Public IP: 152.70.70.70
Interface: ens3
Subnet: 10.0.0.0/24
The OpenVPN server already provides VPN connectivity and has Internet NAT functionality configured.
EBS Server
The EBS server is located in:
Subnet: appsolworldpriv
CIDR: 10.0.1.0/24
EBS Server IP: 10.0.1.193
The EBS server is intentionally located in a private subnet.
2. Initial EBS Connectivity Check
The EBS server was checked for Internet connectivity.
DNS resolution was working, meaning the server could resolve external hostnames. However, direct Internet connectivity was not working.
For example:
getent hosts google.com
successfully returned an address, while:
ping -c 4 8.8.8.8
failed.
This established that the problem was not DNS, but rather the Internet routing/NAT path.
The EBS server's operating-system default gateway remained:
10.0.1.1
There was no need to replace the Linux default gateway with the OpenVPN server's IP.
3. EBS NSG Verification
The EBS server's Network Security Group was checked.
The existing egress rule already allowed:
Destination: 0.0.0.0/0
Protocol: All
Therefore, an additional TCP 465 egress rule was not required at the NSG level.
This is an important distinction:
Security rules allow traffic, but they do not provide the routing/NAT path to the Internet.
The missing component was the routing/NAT architecture.
Also, TCP 465 should not be opened as an inbound rule on the EBS server because SMTP communication with Zoho is initiated by EBS.
4. OpenVPN Server Network Verification
The OpenVPN server was examined to determine whether it could be used as the NAT/router for the EBS subnet.
The server's interface configuration showed:
ens3
Private IP: 10.0.0.33/24
The routing table showed:
default via 10.0.0.1 dev ens3
10.0.0.0/24 dev ens3
The OpenVPN tunnel networks were also present:
172.27.224.0/22
172.27.228.0/22
172.27.232.0/22
172.27.236.0/22
This confirmed that the OpenVPN server has a valid route toward its Internet gateway.
5. IP Forwarding Verification
Linux IP forwarding was checked on the OpenVPN server.
The result was:
net.ipv4.ip_forward = 1
Therefore, IP forwarding is already enabled.
This is an essential requirement because the OpenVPN server will eventually forward traffic originating from:
10.0.1.0/24
toward the Internet.
6. Existing OpenVPN NAT Configuration
The existing OpenVPN Access Server configuration was also inspected.
The server already contains Access Server-managed NAT chains, including:
AS0_NAT_PRE
AS0_NAT_TEST
AS0_NAT
and an existing SNAT rule associated with the external interface:
ens3
The existing NAT rules demonstrate that the OpenVPN server is already performing NAT for VPN traffic.
However, we did not assume that the existing Access Server NAT automatically handles traffic originating from the EBS subnet.
This is important because OpenVPN Access Server manages its own firewall/NAT chains, and manually modifying its configuration without checking the existing rules could result in conflicting or non-persistent rules.
Therefore, the EBS-specific NAT configuration will be handled as a separate step.
7. OCI VNIC Source/Destination Check
The OpenVPN server's Primary VNIC was inspected.
The following setting was found:
Skip Source/Destination Check: No
For the planned routing architecture, this needs to be changed to:
Skip Source/Destination Check: Yes
This allows the OpenVPN server to forward traffic that is not directly addressed to the server itself.
The change is required because the OpenVPN server will act as a router/NAT device between the EBS subnet and the Internet.
8. Existing OCI Route Table
The initial route table was inspected.
The existing default route table contains:
Destination: 0.0.0.0/0
Target Type: Internet Gateway
Target: Internet Gateway vcn-appsolworldblog
Both the OpenVPN subnet and the EBS subnet were using this default route table.
Therefore, we decided not to modify the existing default route.
Changing the existing:
0.0.0.0/0 → Internet Gateway
to:
0.0.0.0/0 → 10.0.0.33
could affect other resources using the same route table, including the OpenVPN server itself.
9. EBS Subnet Identification
The EBS subnet was identified as:
Subnet Name: appsolworldpriv
CIDR: 10.0.1.0/24
with the EBS server:
10.0.1.193
This confirmed that a dedicated route table can be associated specifically with the EBS subnet.
10. Dedicated EBS Route Table Created
Instead of modifying the existing default route table, a new route table was created specifically for the EBS subnet.
The route table was created in the same OCI compartment and VCN as the existing infrastructure.
The intended route is:
Destination: 0.0.0.0/0
Target Type: Private IP
Target: 10.0.0.33
The resulting traffic path will be:
EBS Server
10.0.1.193
|
| OCI Route Table
| 0.0.0.0/0
↓
OpenVPN Server
10.0.0.33
|
| NAT
↓
Internet
|
↓
Zoho SMTP
smtppro.zoho.in:465
This approach avoids the cost of deploying a separate OCI NAT Gateway.
11. Why a Dedicated Route Table Was Used
Using a dedicated route table is safer than changing the VCN's default route table.
The architecture becomes:
VCN
|
┌────────────┴─────────────┐
| |
↓ ↓
OpenVPN Subnet EBS Subnet
10.0.0.0/24 10.0.1.0/24
| |
| |
10.0.0.33 10.0.1.193
| |
↓ ↓
Internet Gateway EBS-specific Route Table
|
↓
10.0.0.33
The OpenVPN subnet retains its existing Internet Gateway route, while only the EBS subnet is directed toward the OpenVPN server.
12. Current Progress
At this stage, the following work has been completed or verified:
| Component | Status |
|---|---|
| EBS private subnet identified | ✅ |
| EBS IP identified | ✅ 10.0.1.193 |
| OpenVPN private IP identified | ✅ 10.0.0.33 |
| OpenVPN public IP identified | ✅ |
| OpenVPN Internet route verified | ✅ |
| Linux IP forwarding verified | ✅ |
| Existing OpenVPN NAT verified | ✅ |
| EBS NSG egress verified | ✅ |
| Existing default route table inspected | ✅ |
| Dedicated EBS route table created | ✅ |
| Existing default route left unchanged | ✅ |
| EBS → OpenVPN route | 🔄 To be finalized/verified |
| Skip Source/Destination Check | 🔄 Needs to be changed to Yes |
| EBS-specific NAT | ⏳ Pending |
| EBS Internet connectivity test | ⏳ Pending |
| Zoho SMTP 465 connectivity test | ⏳ Pending |
| EBS Workflow Mailer configuration | ⏳ Pending |
13. Next Steps
The remaining implementation will be performed in this order:
Step 1 — Enable source/destination forwarding
Change the OpenVPN VNIC:
Skip Source/Destination Check
No → Yes
Step 2 — Associate the dedicated route table
Associate:
EBS-Internet-via-OpenVPN
with:
appsolworldpriv
10.0.1.0/24
Step 3 — Configure EBS subnet NAT
Configure the OpenVPN server to perform SNAT for:
10.0.1.0/24
through:
ens3
This will allow EBS traffic to reach the Internet through the OpenVPN server's public IP.
Step 4 — Test Internet connectivity
From EBS:
ping -c 4 8.8.8.8
Then:
curl -I https://google.com
Step 5 — Test Zoho SMTP
DNS:
getent hosts smtppro.zoho.in
Port connectivity:
nc -vz smtppro.zoho.in 465
The expected result is a successful TCP connection.
Step 6 — Configure Oracle Workflow Notification Mailer
Once network connectivity is confirmed, configure the EBS Workflow Mailer to use:
SMTP Server:
smtppro.zoho.in
SMTP Port:
465
Security:
SSL
SMTP Account:
contact@appsolworld.com
If inbound Workflow replies are required, the corresponding Zoho IMAP configuration can be configured separately using the appropriate Zoho IMAP endpoint and SSL port.
Final Architecture
The completed architecture will be:
INTERNET
│
│
152.70.70.70
│
┌───────▼────────┐
│ OpenVPN Server │
│ 10.0.0.33 │
│ NAT + Router │
└───────┬────────┘
│
OCI VCN
│
┌─────────────▼─────────────┐
│ EBS Private Subnet │
│ 10.0.1.0/24 │
│ │
│ EBS: 10.0.1.193 │
└─────────────┬─────────────┘
│
│ SMTP/SSL
│ TCP 465
▼
smtppro.zoho.in
Key design principle
The EBS server remains private and VPN-accessible, while its outbound Internet traffic is routed through the existing OpenVPN Access Server. No OCI NAT Gateway is required for this design.
Similar posts
There are no similar posts yet.0 comments
There are no comments.