使用 VPC 对等互连连接 VPN 客户端

Question

Situation

• I have a VPN Server running on VPC-A. IP 10.10.39.198
• I have multiple VPN Clients connected on VPN Server. All clients have IPs in the 172.16.0.0/15 range
• I have an APP Server running on VPC-B.

I now need to communicate between the App Server and a VPN client.

What have I done

• Setup VPC Peering connection between VPC-A and VPC-B
• Setup routing tables between VPC-A and VPC-B. VPC-B is configured to route 172.16.0.0/15 to VPC-A

What works

• VPN Server can ping the VPN clients
• App Server can ping the VPN Server.

And there is where I am stranded now. The App server can't reach the clients of the VPN Server.

Traceroute stays dark (only starts). While a traceroute to the VPN server is ok. What exactly am I missing here?

Answer 1

The problem you have here is transitive routing. When trying to go from the app in VPC B to the clients, you're transiting VPC A. By default, this won't work.

What you can do is set up a transit gateway and configure the routing appropriately from there. VPC A would be your transit hub, and VPC B would be a spoke.