AWS inter-subnet routing issue - amazon-web-services

Question

I have a VPC ( say vpc-a ) with CIDR range 192.170.0.0/16 .
I have created 3 subnets in the VPC which are as follows:
> aws ec2 describe-subnets --filters Name=vpc-id,Values=vpc-05d932bbfd4bfe3c5
{
"Subnets": [
{
"AvailabilityZone": "ap-south-1b",
"AvailabilityZoneId": "aps1-az3",
"AvailableIpAddressCount": 57,
"CidrBlock": "192.170.80.0/26",
"DefaultForAz": false,
"MapPublicIpOnLaunch": true,
"State": "available",
"SubnetId": "subnet-0a4c7cc6faa094318",
"VpcId": "vpc-05d932bbfd4bfe3c5",
"OwnerId": "336282279309",
"AssignIpv6AddressOnCreation": false,
"Ipv6CidrBlockAssociationSet": [],
"Tags": [
...
],
"SubnetArn": "arn:aws:ec2:ap-south-1:336282279309:subnet/subnet-0a4c7cc6faa094318"
},
{
"AvailabilityZone": "ap-south-1a",
"AvailabilityZoneId": "aps1-az1",
"AvailableIpAddressCount": 48,
"CidrBlock": "192.170.0.0/26",
"DefaultForAz": false,
"MapPublicIpOnLaunch": true,
"State": "available",
"SubnetId": "subnet-0b6e7a1e1840713a9",
"VpcId": "vpc-05d932bbfd4bfe3c5",
"OwnerId": "336282279309",
"AssignIpv6AddressOnCreation": false,
"Ipv6CidrBlockAssociationSet": [],
"Tags": [
...
],
"SubnetArn": "arn:aws:ec2:ap-south-1:336282279309:subnet/subnet-0b6e7a1e1840713a9"
},
{
"AvailabilityZone": "ap-south-1c",
"AvailabilityZoneId": "aps1-az2",
"AvailableIpAddressCount": 49,
"CidrBlock": "192.170.160.0/26",
"DefaultForAz": false,
"MapPublicIpOnLaunch": true,
"State": "available",
"SubnetId": "subnet-0e45e8fc489794ea9",
"VpcId": "vpc-05d932bbfd4bfe3c5",
"OwnerId": "336282279309",
"AssignIpv6AddressOnCreation": false,
"Ipv6CidrBlockAssociationSet": [],
"Tags": [
...
],
"SubnetArn": "arn:aws:ec2:ap-south-1:336282279309:subnet/subnet-0e45e8fc489794ea9"
}
]
}
So basically 3 subnets are:
subnet-0 CIDR: 192.170.0.0/26 Zone: ap-south-1a
subnet-1 CIDR: 192.170.80.0/26 Zone: ap-south-1b
subnet-2 CISR: 192.170.160.0/26 Zone: ap-south-1c
The route tables are as follows:
aws ec2 describe-route-tables --filters Name=vpc-id,Values=vpc-05d932bbfd4bfe3c5
{
"RouteTables": [
{
"Associations": [
{
"Main": true,
"RouteTableAssociationId": "rtbassoc-02f438a98c50824f2",
"RouteTableId": "rtb-04a14541aaf44b1d1",
"AssociationState": {
"State": "associated"
}
}
],
"PropagatingVgws": [],
"RouteTableId": "rtb-04a14541aaf44b1d1",
"Routes": [
{
"DestinationCidrBlock": "192.170.0.0/16",
"GatewayId": "local",
"Origin": "CreateRouteTable",
"State": "active"
}
],
"Tags": [],
"VpcId": "vpc-05d932bbfd4bfe3c5",
"OwnerId": "336282279309"
},
{
"Associations": [
{
"Main": false,
"RouteTableAssociationId": "rtbassoc-047cce5bf22b50a76",
"RouteTableId": "rtb-08371ccc1f79ebfe6",
"SubnetId": "subnet-0e45e8fc489794ea9",
"AssociationState": {
"State": "associated"
}
},
{
"Main": false,
"RouteTableAssociationId": "rtbassoc-0fbf237d4b7af1b57",
"RouteTableId": "rtb-08371ccc1f79ebfe6",
"SubnetId": "subnet-0a4c7cc6faa094318",
"AssociationState": {
"State": "associated"
}
},
{
"Main": false,
"RouteTableAssociationId": "rtbassoc-066c66d94f1aa32a5",
"RouteTableId": "rtb-08371ccc1f79ebfe6",
"SubnetId": "subnet-0b6e7a1e1840713a9",
"AssociationState": {
"State": "associated"
}
}
],
"PropagatingVgws": [],
"RouteTableId": "rtb-08371ccc1f79ebfe6",
"Routes": [
{
"DestinationCidrBlock": "192.168.0.0/24",
"TransitGatewayId": "tgw-065d7ae5e846681b0",
"Origin": "CreateRoute",
"State": "active"
},
{
"DestinationCidrBlock": "192.170.0.0/16",
"GatewayId": "local",
"Origin": "CreateRouteTable",
"State": "active"
},
{
"DestinationCidrBlock": "0.0.0.0/0",
"GatewayId": "igw-0d37c7db290bf696c",
"Origin": "CreateRoute",
"State": "active"
}
],
"Tags": [
{
"Key": "Name",
"Value": "wqw"
}
],
"VpcId": "vpc-05d932bbfd4bfe3c5",
"OwnerId": "336282279309"
}
]
}
I have 2 ec2 instances :
instance-1 Subnet: subnet-0 , IP : 192.170.0.57
instance-2 Subnet: subnet-1 , IP : 192.170.80.6
I am unable to do ssh from instance-1 to instance-2 or vice-varsa. However I am able to ssh to both of them from another instance in another vpc with cidr 192.168.0.0/16 using transit gateway, which you may find in the routing information above.
Do I need to add additional routing info between the subnets subnet-0 & subnet-1 ? If so what would be the "target" of such route ? I tried enabling flow-log on the vpc but nothing came in cloud-watch logs.
Appreciate some help here.

Answer 1

The local VPC route will always be allowed so this is not a routing issue.
Check the following:
Security Groups
NACLs.
Also take a look at VPC Flow Logs and enable on both subnets. Look for REJECTs.