Im trying to get a very simple setup to work,

I have 2 AWS ec2 instances (blue),

instance B has a Ipsec VPN into our datacenter and can ping internal IPs of this datacenter, ie server C (

enter image description here

I need ec2 A instance to be able to ping and connect to server C by using B as a hop. Both A and B are on same subnet. I tried adding B's IP as a gateway on A,

  root@A>  ip route add via

and also setup firewall rules on B to forward traffic (sysctl ip4 forwarding = 1),

iptables -A FORWARD -s 0/0 -d -j ACCEPT
iptables -A FORWARD -s -d 0/0 -j ACCEPT
iptables -t nat -A POSTROUTING -d 0/0 -s -j MASQUERADE

But I cannot ping C from A. What am I missing?

All hosts are Centos 7.

Thank you.

  • 3
    Did you add the reverse route on C to send packets to A via B? Mar 14, 2019 at 20:54

4 Answers 4


EC2 instances by default have source/destination checking enabled on their network interfaces which means they won't work as routers until you disable it. See https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck

  • ha that was it! Thanks for pointing this out, I removed SrcDest check from EC2 instance, and now I can forward w/o using GRE tunnel. would've never caught that by myself!
    – perfecto25
    Mar 18, 2019 at 20:42

Usually iptables have standard rule for block forwarding traffic. You should remove it to allow traffic pass.

You should remove rule:

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

Are your instances allowed to communicate on intended ports inside subnet explicitly using Security Groups?

As I did this assumption myself I must suspect this, ec2 instances within the same subnet/SecurityGroup are not able to communicate out of the box without adding the necessary rules as pointed here: https://forums.aws.amazon.com/thread.jspa?threadID=77771

If you've already carefully added the appropriate rules, then maybe you can try looking at the flow of packets using tcpdump and filtering on appropriate interface?

  • Yes, I opened up both A and B to Allow All on the security groups. I think the problem is with my route from A to B, running tcpdump on B, its not showing anytthing coming in from B root@A > ip route get is showing the correct gateway (B is the gateway) root@ip-172-25-25-100 /h/centos# ip route get via dev eth0 src cache root@ip-172-25-25-100 /h/centos# ping PING ( 56(84) bytes of data. ^C
    – perfecto25
    Mar 14, 2019 at 21:00

I ended up using a GRE tunnel to route all traffic via server B

the tunnel is between A and B, on A I also add a route to route all traffic for C via GRE tunnel

so it works like this, A > gre tun > B > ipsec vpn tun > C

** note, see comment above about source/dest check on EC2 instances.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .