You could continue down this path, but I'm going to suggest taking a step back and trying a rather different approach.
You have a bunch of servers. You want them to be able to talk to each other, but you want to make sure that those connections are secure, and (I think) also block external connections to all servers other than a bastion host or two. Rather than operating all these servers on a public network, and connect them with a VPN, I think you'd be much better off utilizing a private network. In particular, I'd recommend moving to Amazon VPC.
You can create a VPC and put all of your servers in it. Server-to-server connections all go over the local network, and use a security group to poke a hole for ports 80 and 443 to your load balancer. For your own access, you can either set up a tunnel into your local network, or run a VPN server that you connect to. And yes, I'd recommend having this be on its own server - with virtualized servers, there's really no reason to combine multiple things onto one machine, and it helps reduce the number of things you have to think about on each one, from a security and dependency perspective.
This will be a much cleaner, performant, and well-supported setup than what you're creating now.