I've been following the instructions here: https://aws.amazon.com/blogs/networking-and-content-delivery/simulating-site-to-site-vpn-customer-gateways-strongswan/
I can successfully get the VPN up and running, but I can't successfully ping internal IP addresses from behind the VPN.
Here's my setup:
"On-prem" is simulated using a VPC with IP address: 172.19.0.0/16. The VPN is deployed on an EC2 instance in the subnet 172.19.16.0/20. This subnet has the following route table:
Destination
Target
172.19.0.0/16
local
172.21.0.0/16
eni-XXXXXXXXX
0.0.0.0/0
igw-XXXXXXXXX
Where eni-XXXXXXXXX is the network interface of the EC2 instance that has the VPN deployed on it.
My cloud VPC has the CIDR range: 172.21.0.0/16. I have an EC2 instance deployed in the 172.21.32.0/20 subnet which has the following route table:
Destination
Target
172.21.0.0/16
local
172.19.0.0/16
vgw-XXXXXXXXX
0.0.0.0/0
igw-XXXXXXXXX
Where the vgw-XXXXXXXXX is the virtual gateway associated with the VPN I have.
I can send traffic from my "on-prem" VPC into my cloud VPC successfully, but no traffic comes back out. I've tested this by SSHing into an EC2 instance in my "on-prem" VPC and then pinging a private IP address of an EC2 instance in my cloud VPC and I can see the pings are received by the EC2 instance in the cloud VPC, but my "on-prem" instance never receives the response.
I have checked my security groups and NACLs and they are not preventing this type of traffic.
Is there something misconfigured here?
This is not an entirely satisfying answer, but I moved from using a Virtual Private Gateway to using a Transit Gateway and I was able to get it to work.
Related
i've an elastic IP associated with my instance
i've security group of instance permits incoming connections
my instance firewall permits incoming connections
my application listens
i allowed specifically the Echo Request protocol in the ICMP inbound
traffic of my EC2 instances.
In the past I could ping the domain name linked to my machine.
After looking for where the error could have come from I realized that in elastic IP there was no NAT Gateway associated.
I can't remember if this is necessary or not ?
i guess this issue is coming from here .
Function of NAT gateway is to enable instance in a private subnet to connect to the internet and prevent the internet from initiating a connection with those instance. NAT gateway need elastic IP. So if you have an NAT gateway configured then one EIP should be attached with it. In your case this EIP is attached to an EC2 instance not to NAT gateway thats why it showing no NAT gateway attached.
Your issue might be with security group rules. Check your SG. To exactly answer your question please add more information in your question like..Where your instance launched. In public subnet or in private subnet ? Have you attached EIP to instance launched in private subnet ? What is the inbound rules configured in SG ? what is the command you are using ?
Update:
Instance were launched in private subnet. After adding routes for IGW in the route table of the subnet, this issue has been resolved
I have a AWS RDS instance (PSQL), which is public accessible. For testing I attached a Security group that has on port 5432 all access 0.0.0.0/0. My VPC has a Internet Gateway attached and has the following
192.168.0.0/16 local
0.0.0.0/0 igw-0f41c33417cbccb8c
If I try to connect to the instance I get a network timeout and it seems my request is blocked.
But I dont find anything else that should block the connection
If it helps the VPC and the subnets are default and created for eksctl the major adaption I made was attaching a Internet Gateway
From inside the VPC I can access the RDS instance from outside (eg my local machine I can't)
I've created a VPC with IPv4 CIDR 172.16.0.0/16, next I've created three subnets:
subnet_1 172.16.0.0/20
subnet_2 172.16.16.0/20
subnet_3 172.16.32.0/20
Next I created an Internet Gateway attached to the VPC.
At this point I've created an EC2 instance and I attached to it an Elastic IP. On this instance I have installed an OpenVPN access server.
I then created a second EC2 instance that only has a private IP address. In my mind I thought that once connected via VPN I should able to ssh into the second EC2 instance with a private IP, but I'm not able to connect. What might I have done wrong?
EDIT: I edit the post with some additional information
This is how I configured my VPC
My subnets attached to the VPC
The internet gateway attached to VPC
This is my EC2 instance with OpenVpn access server, with his Elastic Ip so that I can access from my browser
Inbound rules for security group of vpn instance
And the outbund rules
The second and private instance (the instance to which I want to connect via VPN)
Inbound rules
And outbund rules
In OpenVpn access server I do this configurations
And when I connect to the VPN I receive this address 172.16.128.2 (for example)
I have one host which restricts SSH access to it from a list of allowed IP's.
On bunch of AWS EC2 instances I have a worker apps which attempts to establish SSH connection with my host. Number of EC2 instances will be changing in future and I don't want to configure my host every time.
Is there a simple way to redirects all of outbound SSH traffic through single machine with one IP?
Have you looked at a NAT gateway?
Put your EC2 instances in a private subnet, route all traffic from the private subnnet to 0.0.0.0/0 thru the NAT, and that should solve your problem.
Update:
The NAT gateway is a managed service, which replaces the NAT instance. NAT gateway can scale up to 45Gbps. Each NAT gateway gets an Elatic IP per subnet.
I have this current Cloudformation config setup:
PasteBin example here
This runs a web app, there's also some networking config in there which routes outbound traffic through a nat gateway with an elastic ip.
--
Separately we have a manually created site-to-site VPN setup in AWS
screenshot, elastic ip created by cloudformation :
The other side of the VPN specified that our private ip range for the connection to work has to be in 192.168.242.0/24.
Also they have specifically whitelisted 192.168.242.230 at their end. Which is the private ip of the elasticip which the Cloudformation above created.
How can I establish a connection from my EBS ec2 instance to a server protected by this VPN? At the moment the connection just times out.
You would need to add a route table rule to allow traffic to X.X.X.X/X flow via the Virtual Private Gateway(vgw-xxxxxx)
Destination Target
x.x.x.x/x vgw-xxxxxx