1

I am trying to bridge an office network with an Amazon VPC cloud network. So far everything seems to be working, except that I cannot reach servers on the same subnet as the cloud gateway.

Office subnet: 10.0.0.0/24
Cloud subnet: 10.1.0.0/16
Public subnet: 10.1.0.0/24
Private subnet: 10.1.2.0/24

I have IPsec site to site vpn (openswan) set up from the office subnet to the cloud subnet between two linux (ubuntu 14.04 LTS) gateways. The office gateway is in the office subnet, the cloud gateway is in the public subnet.

From computers in the office subnet I can ping the cloud gateway and a server in the private subnet, and vice versa. However, I cannot ping a server on the same (public) subnet as the cloud gateway from the office network, nor the office gateway. I can, however, ping from the cloud gateway to the server. Traceroute from the office gateway to the server in the public subnet shows the cloud gateway as the first hop, but nothing beyond that.

I have a feeling I'm missing something in iptables. Or openswan?

http://pastebin.com/wBzBCqWq - nat tables and ipsec.conf for both gateways

This is sort of what I was going for: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenario2.html

Let me know if I can clarify further or provide anything else, and thanks in advance.

1 Answer 1

1

Turned out to be a problem in the VPC routing tables. The public subnet routing table was not routing traffic destined for the office subnet back to 10.0.0.0/24.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .