1

I have a IPSec tunnel from my on-prem network (10.3.0.0) to a Google VPC network, for example 10.254.0.0. It looks like this:

[10.3.0.0/24] <-- IPSec (routers, gateways, etc.) --> [10.254.0.0/16]

I setup routing properly, I can reach both networks both ways. Now the question is: can I route all my on-prem Internet traffic through VPC network?

Google's VPC networks are special in the way they have routing rules created for them. I created all sorts of custom routes trying to route my packets (for example on my on-prem router: 0.0.0.0/0 via 10.254.0.1, the default gateway for the 10.254.0.0/16 network; the VPC knows how to route back to 10.3.0.0/16, but won't ). I also tested a lot of different cases.

Is it possible at all? What one have to do to make ping 1.1.1.1 works from on-prem machine with all traffic pushed through the tunnel? Help please.

Best Regards, K.

1

You can access to the internet from your on premise network through the VPC network by setting up a GCE instance configured as a NAT-Gateway. You will find the information on how to set this up at this link.

Once you have set up and configured the instance you will need to add The default route that sends all traffic to the internet (0.0.0.0/0) to the NAT-gateway instance.

Then you should add a route with low priority route that applies only to the NAT-gateway instance, using network tags and make the next hop the default Internet gateway.

You will need to configure 0.0.0.0/0 IP range on the on-premise network through your cloud VPN tunnel, so it sends all traffic through the tunnel to the NAT gateway in the VPC network which will then send all the packets to the internet. You can find details on networks and VPN tunnel routing at this link2.

I hope this helps.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.