AWS：无法从VPN ping到其他区域的实例

Question

I have an inter-region VPN setup in AWS, along the lines of this guide:

http://fortycloud.com/interconnecting-two-aws-vpc-regions/

So, I have got things working to some extent, but I cannot ping from one instance to the VPN host.

So the network looks like this:

instance A <---> vpn A <--- (cross region) ---> vpn B <---> instance B

I can ping from VPN to VPN. I can ping from VPN A to instance B. I can ping from instance A to VPN A. I can ping from VPN B to instance B.

But I CANNOT ping from VPN B to instance A, or vice versa. All the routing tables and security groups appear to be correct.

Anything else I may be missing?

---

Here is the info:

VPN A openswan config:

[root@ip-10-1-200-220 ipsec.d]# cat me-to-or.conf
conn me-to-or
        type=tunnel
        authby=secret
        left=%defaultroute
        leftid=52.8.x.x
        leftnexthop=%defaultroute
        leftsubnet=10.1.0.0/16
        right=54.213.x.x
        rightsubnet=10.0.0.0/16
        pfs=yes
        auto=start

VPN B openswan:

conn me-to-ca
        type=tunnel
        authby=secret
        left=%defaultroute
        leftid=54.213.x.x
        leftnexthop=%defaultroute
        leftsubnet=10.0.0.0/16
        right=52.8.x.x
        rightsubnet=10.1.0.0/16
        pfs=yes
        auto=start

Instance A Security Group:

 All traffic FROM ANYWHERE

Instance B sec group:

 All traffic FROM ANYWHERE

VPN A Sec Group:

 All traffic FROM ANYWHERE

VPN B Sec group:

All traffic FROM ANYWHERE

Ping results:

On VPN A (To Instance B):

[root@ip-10-1-200-220 ipsec.d]# ping 10.0.5.130
PING 10.0.5.130 (10.0.5.130) 56(84) bytes of data.
64 bytes from 10.0.5.130: icmp_seq=1 ttl=63 time=21.0 ms

on VPN B (to Instance A):

[root@ip-10-0-200-251 ipsec.d]# ping 10.1.5.54
PING 10.1.5.54 (10.1.5.54) 56(84) bytes of data.
100% packet loss

If I ping from VPN B to Instance A, I can watch the ping hit VPN A (with TcpDump), but it never gets to Instance A. However, if I ping from VPN A to Instance A, that works.

If I ping from Instance A to VPN B, I see the ping go to VPN A, VPN B, back to VPN A, but it never gets to Instance A.

Here's an image from the linked article, to help think about the topology:

---

Answer 1

Finally found it.

I missed this step on VPN A:

Select the Instance in the Instance List and then Click on the “Action button”. Select the “Change Source/Dest. Check”. Click on the “Yes disable” button (this is a critical step, without it the Virtual Routers will not accept or forward traffic that is not intended to the Routers themselves, hence they won't function as Virtual Routers).

Thanks you guys for your help in clarifying my thinking.

Answer 2

Happened to me too, I was able to ping to the openswan instance, but couldn't ping anything behind it. Once I disabled the Source/Dest check the traffic flowed through nicely.