Answers: <p>How are you trying to connect to the remote service? - IP address, default internal/external DNS name or custom DNS name private/public hosted zone?
  Please compare the output of nslookup to the remote service in both the VPCs. If the IPs resolving are different, the traffic is trying to go through the public internet and not the peering connection.</p>
  <p>It would most probably be the need to either <a href="https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zone-private-associate-vpcs.html" rel="nofollow noreferrer">share the private hosted zone with the peered VPC</a> or <a href="https://docs.aws.amazon.com/vpc/latest/peering/modify-peering-connections.html#vpc-peering-dns" rel="nofollow noreferrer">share internal hostnames across the peering connection</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2020-06-23T09:02:45.567Z
Answers: 2020-06-23T09:02:45.567Z
Answers: Mikhail Advani
Body: <p>I have a question regarding some AWS infra I'm trying to build.  Due to legacy constraints, I have a service running in a remote VPC that I need to access, and I have a new service I'm developing in another VPC.  the reason the 2 VPCs are separate is because the newer VPC is managed by Terraform and I am planning to migrate all the services into Terraform but it's going to take a long time, so for the present time I want to connect the 2 VPCs using AWS VPC Peering (I own both VPCs and both services, I can control anything in this infrastructure, except for the remote service code and deployment details which is a black box).</p>
  
  <p>The remote service I believe is deployed as a single EC2 instance, the new service is deployed using ECS Fargate with an ALB on top.  There are 3 security groups involved; the remote instance security group, the ECS security group, and the ALB security group.</p>
  
  <p>I looked at the documentation <a href="https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html" rel="nofollow noreferrer">here</a> as well as a bunch of related pages, and did the appropriate steps.  In particular, I did:</p>
  
  <ul>
  <li>Create the VPC Peering connection</li>
  <li>Accept the peering connection</li>
  <li>Add entries to both VPC routing tables where the destination is the other VPC's CIDR block and the destination is the ID of the peering connection</li>
  <li>Add a TCP exception to the remote service security group to allow incoming traffic from the ECS security group (by security group ID), and vice-versa</li>
  <li>Check my Network ACL to make sure I have an Allow rule to accept traffic</li>
  </ul>
  
  <p>For some reason, when I try to make my request over the peering connection, the request gets thrown into the void and never returns.  It's not logged on the remote server meaning that I don't think it ever arrives.  I spun up an EC2 instance inside the ECS security group and tried to call the remote resource manually (using curl) and that didn't work either.</p>
  
  <p>I've followed all the guides I could find and can't figure this out, but I'm a newbie to AWS so maybe there's something I missed.  Does anyone have any other ideas?  Thanks.</p>
  
Tags: <amazon-web-services><security><aws-vpc>
Title: Unable to connect to remote service using AWS VPC Peering
UserDisplayName: Ertai87
ThreadText: # Unable to connect to remote service using AWS VPC Peering
  
  (Asked by: username_0 on 2020-01-09)
  
  I have a question regarding some AWS infra I'm trying to build. Due to legacy constraints, I have a service running in a remote VPC that I need to access, and I have a new service I'm developing in another VPC. the reason the 2 VPCs are separate is because the newer VPC is managed by Terraform and I am planning to migrate all the services into Terraform but it's going to take a long time, so for the present time I want to connect the 2 VPCs using AWS VPC Peering (I own both VPCs and both services, I can control anything in this infrastructure, except for the remote service code and deployment details which is a black box).
  
  The remote service I believe is deployed as a single EC2 instance, the new service is deployed using ECS Fargate with an ALB on top. There are 3 security groups involved; the remote instance security group, the ECS security group, and the ALB security group.
  
  I looked at the documentation [here](https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html) as well as a bunch of related pages, and did the appropriate steps. In particular, I did:
  
  * Create the VPC Peering connection
  * Accept the peering connection
  * Add entries to both VPC routing tables where the destination is the other VPC's CIDR block and the destination is the ID of the peering connection
  * Add a TCP exception to the remote service security group to allow incoming traffic from the ECS security group (by security group ID), and vice-versa
  * Check my Network ACL to make sure I have an Allow rule to accept traffic
  
  For some reason, when I try to make my request over the peering connection, the request gets thrown into the void and never returns. It's not logged on the remote server meaning that I don't think it ever arrives. I spun up an EC2 instance inside the ECS security group and tried to call the remote resource manually (using curl) and that didn't work either.
  
  I've followed all the guides I could find and can't figure this out, but I'm a newbie to AWS so maybe there's something I missed. Does anyone have any other ideas? Thanks.
  
  **Tags:** amazon-web-services, security, aws-vpc
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2020-06-23. Score: 1
  
  How are you trying to connect to the remote service? - IP address, default internal/external DNS name or custom DNS name private/public hosted zone?
  Please compare the output of nslookup to the remote service in both the VPCs. If the IPs resolving are different, the traffic is trying to go through the public internet and not the peering connection.
  
  It would most probably be the need to either [share the private hosted zone with the peered VPC](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zone-private-associate-vpcs.html) or [share internal hostnames across the peering connection](https://docs.aws.amazon.com/vpc/latest/peering/modify-peering-connections.html#vpc-peering-dns)
  
  
  ---
  
  