Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been trying for a long time now to configure a site-to-site VPN connection between Amazon and a Checkpoint R75.20 (previously i tried with Azure) unsuccessfully. I have tried everything and followed lots of manuals, and i managed to have the tunnels up and connected, but im not able to see the private network from any of my instances.

When i try to do a traceroute to the server, it stops at the Virtual Private Gateway, and im sure that the problem is that it doesn't know where to send the packages (the VPG and the Customer Gateway are linked trough the VPN tunnels), so i'm trying to configure the route tables and the static addresses, but it's not working.

Any leads on this? I'm still learning about VPNs, but other examaples i have seen are pretty straightforward, so i cant find too many documentation. The best i had was that when i pinged the server, it returned "Destination Net Unreachable".

Also the configuration of the VPN says something about the "next hop", is that configuration mine or for the firewall admin?

Thank you, and if you need any information please ask.

Configuration right now: 2 Subnets: 1 private, 1 public

1 Virtual Private Gateway

1 Internet Gateway

1 Customer Gateway (pointing to the firewall) (static)

2 Route tables (here i think i can fix everything, but i have 3 items, the local subnet, internet and the VPN subnet, this last one pointing to the Virtual Private Gateway)

1 VPN connection with 2 tunnels (this firewall only admits 1 tunnel per ip range, so i can have only one active at the same time, and in the configuration i can add static addresses, where i have the VPN subnet)

1 Linux Instance in the VPC network, public subnet.

share|improve this question
Under the "VPN Connection" object in VPC there is a tab where you also need to declare static routes to your corporate network's private IP address space. Is that set? "Destination net unreachable" messages may include the IP of the networking device that is "reporting" the unreachability to you. Which device is that? Also, see if any of this overview helps. – Michael - sqlbot Nov 12 '13 at 0:54
Yes it is set (it's actually only one ip, so I declared it with /32). – Asfura Nov 12 '13 at 1:09
Yes it is set, and because it is only one ip I declared it with /32. Thank you for that page, the names are very counter-intuitive, and the instructions on the manuals are way too vague. – Asfura Nov 12 '13 at 1:10
There's only one IP address on your corporate network that needs access to/from the VPC servers? This is configuration for the address the machine (or machines, typically) inside the corporate network that need to access the VPC. One seems like a small number. (Just trying to make sure we're discussing the same thing). – Michael - sqlbot Nov 12 '13 at 1:15
I'm trying to connect, form an amazon instance (or azure, i really don't care) to a SMPP server behind a firewall, and of course get the answer from the server on the instance in th VPC. – Asfura Nov 12 '13 at 1:25

I solved it, by doing a classic "have you tried turning it off and on again?", in other words, i removed everything and started by scratch using the VPC Wizard, creating 2 subnets, one private and one public, and after the Wizard adding the Virtual Private Gateway in the route table, in Route Propagation, so it adds the static route to my company's (SMPP server in this case) subnet.

One problem i faced is that the tunnel keep dying after a while without packet transfer, so i added a cron job to ping it every minute.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.