This is what I have done

  • created VPC
  • created subnet
  • created internet gateway
  • attached internet gateway to VPC
  • created routing table
  • set destination route to target the internet gateway
  • associated routing table to subnet
  • launched vyOS on EC2 using subnet with auto IP assigned (ICMP allowed)
  • created elastic IP assigned to vyOS
  • added second network interface eth1 auto IP (default vpc secgroup)
  • rebooted machine
  • set ipsec ike and esp and preshared key with 2 tunnels. Both tunnels up
  • ping from vyOS other side got replies
  • launced another box on same subnet with auto assigned IP with (default vpc secgroup with 22 and 80 allowed from )

I have not been able to ping from but can from the vyOS box itself(with ip I have added a new route on

sudo route add -net gw
ubuntu@ip-192-168-5-40:~$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    0      0        0 eth0
default         UG    0      0        0 eth0   *        U     0      0        0 eth0

I know I am missing a point. NAT translation? Where is the catch? Can anybody points me to the right direction? Thanks in advance

1 Answer 1


Common issue, make sure that you Disable Source/Destination Check on the instance ( right click -> Networking -> Change Source Dest. Check )

You'll only need to do this on the Vyos box.

You also don't really need a second interface. You could create a second subnet and on that route table for that subnet make the 0/0 route point to the Vyos instance if you want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.