We have an AWS account setup with two VPCs. One has a VPN to our main campus (higher ed). We wanted to move our web servers into this VPC so that they could access on campus databases for a few items. The web servers are behind an amazon load balancer (application layer not classic).

The problem we're having is that Internet users can view the website but when the tunnel is active, on campus users cannot access the website. Traffic is flowing to the public IP of the load balancer, then into the web servers and then heading back directly through the VPN tunnel and getting dropped.

Our on campus DNS uses a product called bluecat which can't do very much so ACLs are out of the question on that based on IP. I attempted to look at route53 but aside from their private feature that only works inside the VPC, I don't see any way to choose DNS answers based on IP. Geolocation only works by locations, not IPs.

My only two remaining ideas are to spin u a BIND server inside the public VPC, create a cname on it with a new domain that either gives out the aws load balancer or the private IP of the server behind the load balancer, or to migrate all the private database connections to web app servers inside the VPN VPC and then have public web servers talk to that.

Before I try to go down either of these paths, I wanted to ask if anyone had either a routing solution or a route53 solution to this problem? Are there any pitfalls to the BIND/ACL idea?

  • Can you draw a diagram of your setup, to make things more clear? cloudcraft.co is one way to do this. – Tim Sep 30 '16 at 18:33
  • There is a lot of complexity but here is the link to a draw.io with basics. drive.google.com/file/d/0B0HlOduEZvkHbkp1VzBoM3Vkd1k/… – Lucas Holt Sep 30 '16 at 20:23
  • This seems somewhat complex. My initial impression is the routing inside the VPC is somehow messed up, that traffic coming in from the internet is for some reason going out the VPN connection. Can you post details of how your VPN and routing is set up? It's difficult to diagnose problems from screenshots but the only alternative is getting a login to your account, which crosses over the line between advice and professional services. – Tim Sep 30 '16 at 22:12
  • The routing is a bit of a mess, but I'm not the one who set it up. That is managed by another team. Essentially, it tries to route everything from the uni network /16 and /24s over the VPN. I added an internet gateway and the default route so I could get out to the Internet. – Lucas Holt Sep 30 '16 at 22:36
  • 1
    I suggest you get together with that team and sort things out. I think fixing routing is the key. You probably want to architect things so there's only one route to each service otherwise you'll keep having problems like this. – Tim Sep 30 '16 at 23:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.