Unable to communicate VPN between AWS VPC and On-Place

Asked 2 years ago, Updated 2 years ago, 152 views

Let me ask you a question about the description.
Unable to communicate between vyos servers (VPNs) configured with AWS VPC and installed on-premise (home).
Here's what we're doing now:

Assumptions
 The on-play network is 192.168.11.0/24, the AWS network is 192.168.12.0/24, and 192.168.13.0/24 → private address.

[AWS side]
1 VPC ·Create a dedicated VPC and configure two CIDR blocks (192.168.12.0/24, 192.168.13.0/24)
·Set two subnets (192.168.12.0/24, 192.168.13.0/24)
·The route table is as follows (route, target)
  192.168.12.0/24 local
  192.168.13.0/24 local
  0.0.0.0/0 Internet Gateway
  192.168.11.0/24 Virtual Private Gateway
·Set up one Internet gateway (attached to VPC)
·Network ACLs are as follows
  Inbound rules
   100 All Traffic All Protocol Sources 192.168.11.0/24 Allowed
   * Default deny rule
  Outbound rules
   Leave default (allowed and denied 0.0.0.0/24)
·The security group is as follows. → Associated with the EC2 instance described below
  Inbound rules
   All traffic all 192.168.11.0/24
   All ICMP-IPv4 ICMP(1) All::/0
  Outbound rules
   All traffic 0.0.0.0/0
·Customer Gateway
  Attach to VPC and BGPASN defaults to 65000
·Virtual Private Gateway
  Associated with the above, AmazonASN defaults to 10124
·VPN connection
  Routing is dynamic, customer GW address is home router address (Internet side)

2EC2
·Established EC2 instance (AmazonLinux) and attached to VPC. Private address is 192.168.12.10 (no ElasitIP required, no configuration)

[Home side]
The configuration is as follows:
Default GW Home Router 192.168.11.1
Set to VPN router (vyos) 192.168.11.2 eth1 with only one NIC
Reflect settings downloaded in AWSVPC (local IP of set vpn ipsec site-to-site peer changed to 192.168.11.2)

Based on the above settings, the VPN (ipsec) is stretched without any problems, and the VPC side is up without any problems.Also, there is no problem when you ping the vpn tunnel IP (external address) from vyos (home) as seen from the VPC.
However, we are unable to communicate to EC2 even if we ping or SSH (using AWS-issued keys).
When I monitored the ping in Wireshark, I could see that vyos was communicating with the external IP on the AWS side by ESP, but I checked the flow log on the VPC side, but it seemed that the log was not picked up (not delivered).

Do you know the possible cause?Could you tell me if this configuration (VPN Server → Home Router → Internet → VPC → EC2) works properly?

aws vpn vpc

2022-09-30 19:46

1 Answers

It may have already been implemented, but may the router (192.168.11.1) need NAT traversal?
https://dev.classmethod.jp/etc/aws-vpc-vpn-nat-traversal/


2022-09-30 19:46

If you have any answers or tips


© 2024 OneMinuteCode. All rights reserved.