1

Diagram of our Setup

We have set up AWS VPC in 2 regions as illustrated above. The VPN connection now works between two instances each directly connected to the VPCs at each end of the VPN setup (that is, VPC PROD in eu-west1 and VPC PROD in ap-south1). So "Remote service" can communicate with "Prod service". This is illustrated by the green dotted line.

Since there is a peering connection between the 2 eu-west1 VPCs, I had hoped that VPC PROD in ap-south1 would be able to communicate with VPC ADMIN in eu-west1. This does not seem to be the case. That is, "Remote service" can not communicate with "Admin service". Illustrated by the red dotted line.

VPC ADMIN has routing table entries:

10.100.0.0/16 ==> peering connection to VPC PROD (eu-west1)

VPC PROD (eu-west1) has routing table entries:

10.100.0.0/16 ==> Virtual Private Gateway (VPG) / VPN connection

Also, VPC PROD (ap-south1) has routing table entries:

172.20.0.0/16 and 172.30.0.0/16 ==> strongswan instance.

I imagine the problem could be that traffic from ap-south1 arrives in eu-west1s VPG router and has a hard demand it can reach it's endpoint in the VPGs associated VPC, and it won't look at the VPCs routing table and thus it won't support using the matching routing table entry to send the traffic to the peering connection to VPC ADMIN. Can someone confirm whether or not that is supposed to work?

At the moment the only way to get this going seems to create a second VPN connection which would have a VPG associated with VPC ADMIN. Then adjust routing in ap-south1 to hit the old VPN for 172.20.0.0/16 (VPC PROD) and the new VPN for 172.30.0.0/16 (VPC ADMIN). This should work, but will cost twice as much and means more configuration to maintain...

Other ideas to make it work?

Improve this question
2
  • You're showing your VPN and customer gateway within one VPC, whereas typically VPG and CG are different ends of the connection - probably just a diagram error. Assume SG and NACLs are set up correctly? Best practice document here aws.amazon.com/answers/networking/… and another article here aws.amazon.com/articles/5472675506466066 - there's a lot of details and small steps you should work through, like disabling source/destination checks on the VPN instances.
    – Tim
    Commented Jan 20, 2017 at 18:08
  • @Tim Thanks! Yes, while the CG is set up in the same region as the VPG, I suppose it should have been drawn in the opposite region. SG, NACLs, small steps, lots of details - I agree! However since green arrow is up, most of them are correct, and I've triple checked those extra on the way for the red arrow. :) Turns out it's just not designed to do this, as per Michaels answer ...
    – Magge
    Commented Jan 21, 2017 at 15:36

3 Answers 3

Reset to default
2

This does not work, by design.

Edge to Edge Routing Through a Gateway or Private Connection

If either VPC in a peering relationship has one of the following connections, you cannot extend the peering relationship to that connection:

  • A VPN connection

...

http://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/invalid-peering-configurations.html

VPC peering only allows access from instance to instance across the VPC boundary. It doesn't allow access to any kind of "gateway," like an Internet Gateway, NAT Gateway, VPC Service Endpoint, AWS Direct Connect, or Hardware VPN.

Traffic crossing a peering connection can't "transit" the VPC and get out the other side.

Improve this answer
2
  • Thanks! I had not read this page and it's clearly an invalid setup.
    – Magge
    Commented Jan 21, 2017 at 15:39
  • @Magge There's something else you can do: aws.amazon.com/answers/networking/…
    – eco
    Commented Apr 15, 2020 at 19:53
0

There are a couple of AWS Networking partners that provide peering connections across regions and/or across accounts. https://aws.amazon.com/networking/partner-solutions/

Improve this answer
0

You have to use EC2 instances to provide Edge to Edge routing. Document below https://aws.amazon.com/answers/networking/aws-multiple-vpc-vpn-connection-sharing/ Transit VPC section

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .