Let me ask you a question about the description.
Unable to communicate between vyos servers (VPNs) configured with AWS VPC and installed on-premise (home).
Here's what we're doing now:
Assumptions
The on-play network is 192.168.11.0/24, the AWS network is 192.168.12.0/24, and 192.168.13.0/24 → private address.
[AWS side]
1 VPC
·Create a dedicated VPC and configure two CIDR blocks (192.168.12.0/24, 192.168.13.0/24)
·Set two subnets (192.168.12.0/24, 192.168.13.0/24)
·The route table is as follows (route, target)
192.168.12.0/24 local
192.168.13.0/24 local
0.0.0.0/0 Internet Gateway
192.168.11.0/24 Virtual Private Gateway
·Set up one Internet gateway (attached to VPC)
·Network ACLs are as follows
Inbound rules
100 All Traffic All Protocol Sources 192.168.11.0/24 Allowed
* Default deny rule
Outbound rules
Leave default (allowed and denied 0.0.0.0/24)
·The security group is as follows. → Associated with the EC2 instance described below
Inbound rules
All traffic all 192.168.11.0/24
All ICMP-IPv4 ICMP(1) All::/0
Outbound rules
All traffic 0.0.0.0/0
·Customer Gateway
Attach to VPC and BGPASN defaults to 65000
·Virtual Private Gateway
Associated with the above, AmazonASN defaults to 10124
·VPN connection
Routing is dynamic, customer GW address is home router address (Internet side)
2EC2
·Established EC2 instance (AmazonLinux) and attached to VPC. Private address is 192.168.12.10 (no ElasitIP required, no configuration)
[Home side]
The configuration is as follows:
Default GW Home Router 192.168.11.1
Set to VPN router (vyos) 192.168.11.2 eth1 with only one NIC
Reflect settings downloaded in AWSVPC (local IP of set vpn ipsec site-to-site peer changed to 192.168.11.2)
Based on the above settings, the VPN (ipsec) is stretched without any problems, and the VPC side is up without any problems.Also, there is no problem when you ping the vpn tunnel IP (external address) from vyos (home) as seen from the VPC.
However, we are unable to communicate to EC2 even if we ping or SSH (using AWS-issued keys).
When I monitored the ping in Wireshark, I could see that vyos was communicating with the external IP on the AWS side by ESP, but I checked the flow log on the VPC side, but it seemed that the log was not picked up (not delivered).
Do you know the possible cause?Could you tell me if this configuration (VPN Server → Home Router → Internet → VPC → EC2) works properly?
aws vpn vpc
It may have already been implemented, but may the router (192.168.11.1) need NAT traversal?
https://dev.classmethod.jp/etc/aws-vpc-vpn-nat-traversal/
© 2024 OneMinuteCode. All rights reserved.