0

I have an Amazon EC2 VPC with private IP address range 172.28.0.0/16. Two instances are in the VPC: alpha (172.28.1.13) and bravo (172.28.1.99). The alpha instance is running a pptp server with localip 192.168.13.1 and remoteip 192.168.13.2-250.

I want bravo (172.28.1.99) to ping clients on the the alpha (172.28.1.13) pptp subnet, 192.168.13.0/24. For example if I connect to the VPN on my laptop, and my IP is 192.168.13.2, then bravo (172.28.1.99) should be able to ping me.

This seems like a job for VPC routing tables. So I added an entry to the ec2 routing table: destination 192.168.13.0/24 via instance-id of alpha. Traceroute to 192.168.13.2 from bravo appears to go nowhere.

I am unable to ping 192.168.13.2 from 172.28.1.99.

Sanity checks: all security groups open to world... can ping between bravo and alpha via 172.28.1.13 and 172.28.1.99.

Is there an additional step I need to take after adding an entry to the VPC routing table?

1

EC2 (VPC) instances have an IP source/destination check enabled on their interfaces by default. For NAT instances, as well as configurations like the one you describe, this needs to be disabled for traffic to flow.

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck

2
  • Thank you. Disabling that on both instances allows me to ping 196.168.13.1 (i.e., the EC2 server running the VPN). However, I still cannot ping 192.168.13.2 (the VPN client IP). From the VPN server instance, I was able to ping it after running sudo ip route add 192.168.13.0/24 dev ppp0. However I cannot ping it from the other EC2 instance. – Miles Richardson Oct 21 '15 at 13:51
  • Or -- I suspect -- the client can't reply? The client needs a static route to the 172.28.0.0/16 network over the tunnel, or needs to use the tunnel as its default gateway. – Michael - sqlbot Oct 21 '15 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.