Answers: <p>VPC peering does not support transit traffic.</p>
  
  <p><a href="https://docs.aws.amazon.com/vpc/latest/peering/invalid-peering-configurations.html#edge-to-edge-vgw" rel="nofollow noreferrer">Unsupported VPC Peering Configurations</a> described several scenarious that are not supported.</p>
  
  <p>This case is not specifically mentioned, but is implicit from the other limitations.  </p>
  
  <p>Note also that it is impossible to fully configure the setup you are attempting, because when you route a given destination towards a remote VPC via a peering connection, there is no route table in the target VPC that is applicable to that traffic. Only the instance subnets are available.  Route tables apply only to subnets, and the default route table only applies to subnets without an explicitly assigned route table -- not to incoming traffic from a peering connection.  There is no way to route this traffic back to your instance.</p>
  
  <p>This is why Hardware VPN, Direct Connect, and NAT devices are not available across peering, </p>
  
  <p>A <a href="https://aws.amazon.com/blogs/aws/aws-solution-transit-vpc/" rel="nofollow noreferrer">Transit VPC</a> is not what you have described.  These use AWS VPC Hardware VPN connections on the spokes and an EC2-based <em>router</em> at the hub to terminate the tunnels... and the transit routing between the tunnels is done within the instance -- not by the VPC network infrastructure.</p>
  
Answers: CC BY-SA 4.0
Answers: 2018-10-26T01:06:54.703Z
Answers: 2018-10-26T01:06:54.703Z
Answers: Michael - sqlbot
Body: <p>I am setting up a VPN Server to move all resources behind VPN on AWS, which includes moving multiple VPCs.</p>
  
  <p>The simple setup is:</p>
  
  <p>I have a separate VPC (<code>VPC1</code>) running VPN Server and another VPC (<code>VPC2</code>) with an EC2 machine.</p>
  
  <p>Let's assume the following CIDRs for VPCs &amp; VPN.</p>
  
  <ul>
  <li>VPC1: 10.1.0.0/16</li>
  <li>VPC2: 10.2.0.0/16</li>
  <li>VPN: 10.8.0.0/24</li>
  </ul>
  
  <p>Everything is working fine within VPC1.</p>
  
  <p>Now I have enabled VPC Peering between  <code>VPC1</code> &amp; <code>VPC2</code>, but I am not able to access EC2 machine running in <code>VPC2</code> unless I mask the VPN CIDR as following.</p>
  
  <pre><code>iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
  </code></pre>
  
  <p>But doing so, I lose the source IP of the request.  All requests are forwarded as requested by VPN machine.</p>
  
  <p>Let me know if any other information/clarification is required.</p>
  
Comments: CC BY-SA 4.0
Comments: 2018-10-25T15:15:52.220Z
Comments: What are the security group rules for the EC2 machines in VPC2 and what are the network ACL on VPC2 ?
Comments: Tensibai
Comments: CC BY-SA 4.0
Comments: 2018-10-25T16:53:02.310Z
Comments: SGs are allowing traffic from both CDIR `10.1.0.0/16` & `10.8.0.0/24` in VPC2  and ACL are allowing all traffic.  So far I have investigated, it's the issue with VPC Peering, machines in VPC2 are able to receive requests but unable to respond.
Comments: Dhirendra
Comments: CC BY-SA 4.0
Comments: 2018-10-25T20:21:46.957Z
Comments: I assume vpc2 route table has no route toward 10.8.0.0?
Comments: Tensibai
Comments: CC BY-SA 4.0
Comments: 2018-10-26T09:06:07.767Z
Comments: Yes, that's the problem.
Comments: Dhirendra
Tags: <amazon-web-services><aws-vpc><vpn>
Title: Communication between VPCs and a transit VPC hosting VPN Server without Masking source IP
UserDisplayName: Dhirendra
ThreadText: # Communication between VPCs and a transit VPC hosting VPN Server without Masking source IP
  
  (Asked by: username_0 on 2018-10-25)
  
  I am setting up a VPN Server to move all resources behind VPN on AWS, which includes moving multiple VPCs.
  
  The simple setup is:
  
  I have a separate VPC (`VPC1`) running VPN Server and another VPC (`VPC2`) with an EC2 machine.
  
  Let's assume the following CIDRs for VPCs & VPN.
  
  * VPC1: 10.1.0.0/16
  * VPC2: 10.2.0.0/16
  * VPN: 10.8.0.0/24
  
  Everything is working fine within VPC1.
  
  Now I have enabled VPC Peering between `VPC1` & `VPC2`, but I am not able to access EC2 machine running in `VPC2` unless I mask the VPN CIDR as following.
  
  ```
  iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
  
  ```
  
  But doing so, I lose the source IP of the request. All requests are forwarded as requested by VPN machine.
  
  Let me know if any other information/clarification is required.
  
  **Tags:** amazon-web-services, aws-vpc, vpn
  
  > **Comments:**
  > **username_1**: What are the security group rules for the EC2 machines in VPC2 and what are the network ACL on VPC2 ?  
  > **username_0**: SGs are allowing traffic from both CDIR `10.1.0.0/16` & `10.8.0.0/24` in VPC2  and ACL are allowing all traffic.  So far I have investigated, it's the issue with VPC Peering, machines in VPC2 are able to receive requests but unable to respond.  
  > **username_1**: I assume vpc2 route table has no route toward 10.8.0.0?  
  > **username_0**: Yes, that's the problem.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2018-10-26. Score: 1 | Accepted answer
  
  VPC peering does not support transit traffic.
  
  [Unsupported VPC Peering Configurations](https://docs.aws.amazon.com/vpc/latest/peering/invalid-peering-configurations.html#edge-to-edge-vgw) described several scenarious that are not supported.
  
  This case is not specifically mentioned, but is implicit from the other limitations.
  
  Note also that it is impossible to fully configure the setup you are attempting, because when you route a given destination towards a remote VPC via a peering connection, there is no route table in the target VPC that is applicable to that traffic. Only the instance subnets are available. Route tables apply only to subnets, and the default route table only applies to subnets without an explicitly assigned route table -- not to incoming traffic from a peering connection. There is no way to route this traffic back to your instance.
  
  This is why Hardware VPN, Direct Connect, and NAT devices are not available across peering,
  
  A [Transit VPC](https://aws.amazon.com/blogs/aws/aws-solution-transit-vpc/) is not what you have described. These use AWS VPC Hardware VPN connections on the spokes and an EC2-based *router* at the hub to terminate the tunnels... and the transit routing between the tunnels is done within the instance -- not by the VPC network infrastructure.
  
  
  ---
  
  