How do I use an Amazon VPC peering connection to access an internal load balancer?

Resolution

When you access internal load balancers from a different VPC, you must create a VPC peering connection between your VPCs. If you can't access the load balancer after you create the VPC peering connection, then you can use Reachability Analyzer. Reachability Analyzer identifies the component that's blocking the path. Reachability Analyzer also automatically analyzes the route tables, network access control lists (ACLs), and security groups along the round-trip path, and checks for misconfigurations.

Note: VPC peering is available for connectivity within and across AWS Regions for local AWS accounts or cross-account VPCs.

You can also manually check for misconfigurations in the following areas:

Route table

• Confirm that the load balancer's subnet Classless Inter-Domain Routing (CIDR) or Amazon VPC CIDR exists in the client subnet's route table. Direct the route to the VPC peering IDs.
• Confirm that the route of the client subnet CIDR or Amazon VPC CIDR exists in the route table of the load balancer's subnets.

Network ACL rules

• Confirm that you provided correct network ACL rules for the client subnet and load balancer subnet.

Security groups

Configure your VPC security groups to allow traffic:

• Application Load Balancer: Include the client's IP address, client CIDR, or 0.0.0.0 as the source in the inbound rules of the VPC security group associated with the Application Load Balancer.
• Network Load Balancer: Include the client's IP address, client CIDR, or 0.0.0.0 as the source in the inbound rules of the VPC security group associated with the Network Load Balancer. Also, confirm that the Network Load Balancer is associated with a target security group, and client IP address preservation is turned on. For security group configuration details, see Target security groups.