5

I have different VPCs in different regions in AWS:

  1. 10.1.0.0/16(A)
  2. 10.2.0.0/16(B)
  3. 10.3.0.0/16(C)

I followed this article(http://cloudacademy.com/blog/openvpn-aws-vpc/) to open a vpn connection in order to let server instances in B to communicate RDS instance in private subnet of VPC A.

I did the following in ipsec.conf:

rightsubnet=10.2.0.0/16

Everything works fine but how am I supposed to connect C to A? Do I need to open an another OpenVPN instance? I am pretty sure there is a way to accomplish this.

2 Answers 2

1

For VPC in the Same region:

VPC peering, Set up a VPC Peer connection to the other VPC's. So if the vpn server is in A, creating a VPC peer connection from A to B and A to C.

http://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/Welcome.html

For VPC Peering in Different Regions:

You can Use a software VPN like Openvpn or Strongswan

Leverages AWS networking equipment in-region and Internet pipes between regions

Layer 3 setup with OpenVPN

Layer 2 setup with OpenVPN

https://docs.openvpn.net/how-to-tutorialsguides/administration/extending-vpn-connectivity-to-amazon-aws-vpc-using-aws-vpc-vpn-gateway-service/

https://s3.amazonaws.com/awsmedia/AWS_Amazon_VPC_Connectivity_Options.pdf

3
  • 2
    This will not work. To use peering the VPCs must be in the same region. Aug 26, 2017 at 23:17
  • I downvoted this because, while it is the accepted answer, it is incorrect. :( Sep 18, 2017 at 21:38
  • Updated for cross region.
    – strongjz
    Sep 19, 2017 at 13:35
2

AFAIK you do not need multiple VPNs to connect multiple VPCs. One VPN in each VPC, configured to route accordingly should work. Here is an article with details. See the section "Connecting Additional VPCs"

https://aws.amazon.com/articles/0639686206802544

Unfortunately in order to peer, the VPCs must be in the same region, so peering will not work. Connecting VPCs in different regions is a little more compacted. Here is a link to an article that talks about the different options. The best solutions require some kind of VPN through a corporate network.

https://aws.amazon.com/answers/networking/aws-multiple-region-multi-vpc-connectivity/

Here is the software solution from the article. Of interest, "Ocedo AutoVPN currently provides advanced network automation for launching, managing, and configuring software-based VPN appliances to connect multiple VPCs and full-mesh VPN networks."

Software VPN Appliances

This approach leverages the Amazon VPC capability to create VPN tunnels between EC2 instances in order to route traffic between VPCs in different regions. This option uses customer- or AWS Partner Network (APN) member-managed, EC2-based software VPN appliances and is best suited to customers who want to manage both ends of VPN connections using their preferred VPN software provider.

This design optimizes cross-region network transfer costs, however it requires customers to design and manage their own HA configuration for EC2 network instances.

Configuration Details

This design uses Elastic IP addresses and VPC Internet gateways to facilitate communication between the software VPN appliances. Although EC2 instances are configured with public IP addresses, network traffic between AWS Regions traverse the AWS global network backbone by default, which typically provide more consistent, lower latency network connectivity than equivalent Internet-based connections. AWS Marketplace provides multiple third-party and open source options (including products from Cisco, Fortinet, Ocedo, OpenSWAN, OpenVPN, Palo Alto Networks, Sophos, and Vyatta) for implementing software VPN appliances. Ocedo AutoVPN currently provides advanced network automation for launching, managing, and configuring software-based VPN appliances to connect multiple VPCs and full-mesh VPN networks.

Considerations

Products available in the AWS Marketplace provide additional network control features for monitoring and controlling traffic between VPCs. These include additional security features such as enhanced monitoring, network-protocol-aware firewall rules, or universal threat management capabilities. Note that customers must run network appliances in each VPC, which results in additional EC2 and, potentially, third-party license charges. These EC2 instances can also introduce a single point of failure into the network architecture, and a potential network bottleneck, so be sure to choose a VPN appliance instance size that will meet cross-region network routing requirements. Finally, leverage Auto Recovery for EC2 or other network monitoring and recovery options to decrease the time to recover failed VPN appliances.

1
  • By the way. This is the approach I have settled on. If successful, I'll post back here with implementation details and templates. Aug 26, 2017 at 23:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .