I have an Amazon EC2 VPC with private IP address range Two instances are in the VPC: alpha ( and bravo ( The alpha instance is running a pptp server with localip and remoteip

I want bravo ( to ping clients on the the alpha ( pptp subnet, For example if I connect to the VPN on my laptop, and my IP is, then bravo ( should be able to ping me.

This seems like a job for VPC routing tables. So I added an entry to the ec2 routing table: destination via instance-id of alpha. Traceroute to from bravo appears to go nowhere.

I am unable to ping from

Sanity checks: all security groups open to world... can ping between bravo and alpha via and

Is there an additional step I need to take after adding an entry to the VPC routing table?


EC2 (VPC) instances have an IP source/destination check enabled on their interfaces by default. For NAT instances, as well as configurations like the one you describe, this needs to be disabled for traffic to flow.


  • Thank you. Disabling that on both instances allows me to ping (i.e., the EC2 server running the VPN). However, I still cannot ping (the VPN client IP). From the VPN server instance, I was able to ping it after running sudo ip route add dev ppp0. However I cannot ping it from the other EC2 instance. – Miles Richardson Oct 21 '15 at 13:51
  • Or -- I suspect -- the client can't reply? The client needs a static route to the network over the tunnel, or needs to use the tunnel as its default gateway. – Michael - sqlbot Oct 21 '15 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.