How do I troubleshoot Transit Gateway and VPC internet connectivity issues through a centralized egress VPC?

Short description

Internet connectivity through a centralized egress VPC requires specific routing and security configurations. For information about architecture details, see Using the NAT gateway with AWS Network Firewall for centralized IPv4 egress.

Resolution

Note: This article assumes an Amazon Elastic Compute Cloud (Amazon EC2) instance as the source resource. Before you check resource configurations, identify your resources that connect to the internet. If you use a different resource, then open the AWS Management Console for the AWS service to verify the subnet and security group configuration.

Verify source VPC resources and configuration

Complete the following steps:

1. Open the Amazon EC2 console.
2. In the navigation pane, choose Instances.
3. Identify and select the EC2 instance that can't access the internet.
4. Choose the Security tab.
5. Verify that Outbound rules for the source instance allows internet traffic.
6. On the details pane, choose the Networking tab.
7. Note the VPC, subnet, and Availability Zone that hosts the instance.
8. Select the hyperlink of the subnet that's associated with the instance, and then open the link in a new tab.
9. Open the Amazon Virtual Private Cloud (Amazon VPC) console.
10. Select the subnet and then confirm the following configurations from the Details pane:
    Under Network ACL, confirm that the Inbound rules and Outbound rules allow internet traffic.
    Under Route table, verify that the default route 0.0.0.0/0 exists and points to the transit gateway as the next hop. If this route doesn't exist, then add the default route 0.0.0.0/0 to the route table with the transit gateway as the next hop.

Check the VPC transit gateway attachment

Complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, under Transit gateways, choose Transit gateway attachments.
3. Enter the VPC ID that you identified earlier to filter and view the correct VPC attachment.
4. In the Details pane, check the Subnet IDs field. Then, verify that at least one of the listed subnets is in the same Availability Zone as your instance.

Confirm network ACL association and configuration

Complete the following steps:

1. Open the Amazon EC2 console.
2. In the navigation pane, under Network & Security, choose Network Interfaces.
3. In the search field, use the Interface Type = transit_gateway filter.
4. From the results, select the subnet ID that's associated with the source VPC transit gateway attachment, and then open the details in a new tab.
5. From the new tab, select the subnet again.
6. In the details pane, choose Network ACL.
7. Check your network ACL rules for the following requirements:
   On the Outbound rules tab, verify that outbound rules include the destination public IP address.
   On the Inbound rules tab, verify that inbound rules include the NAT gateway's private IP address.

Note: It's a best practice to configure network ACLs with open inbound and outbound rules for transit gateway subnets.

Check transit gateway association and route table propagations

Complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, under Transit gateways, choose Transit gateway attachments.
3. In the search field, enter the VPC ID of the source EC2 instance. Then, select the IDs of the associated route table.
4. In the Details pane, choose Routes.
5. Verify that the route table includes the destination public IP address or default route that points to the egress VPC attachment.

Verify egress VPC routing configuration for outbound internet traffic and return routing

Identify transit gateway interface and subnet configuration

Complete the following steps:

1. Open the Amazon EC2 console from the AWS account that hosts the egress VPC.
2. In the navigation pane, under Network and Security, choose Network Interfaces.
3. In the search field, enter the Interface Type = transit_gateway filter.
4. From the search results, note each subnet that hosts the egress VPC transit gateway attachment.

Verify outbound internet traffic routing

Complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, under Virtual private cloud, choose Route tables.
3. In the search field, enter the subnet ID that you noted earlier to search for the route table that associates with the subnets.
4. Select the route table, and then in the Details pane, choose Routes.
5. Verify that the route table contains the default route or destination public prefix and points to the NAT gateway.
6. Repeat steps 3 through 5 for each subnet ID.

Verify network ACL and NAT gateway configuration

Complete the following steps:

1. On the Amazon VPC console, in the navigation pane, under Security, choose Network ACLs.
2. In the search field, enter the subnet ID to search for the network ACL that's associated with each subnet.
3. Verify that network ACLs have outbound rules that allow traffic to the destination public IP address and inbound rules traffic from the NAT gateway's private IP address.
4. In the navigation pane, under Virtual private cloud, choose NAT gateway.
5. Note the route table and the Availability Zone for internet bound traffic for each NAT gateway.

Verify return traffic routing

Complete the following steps:

1. On the Amazon VPC console, in the navigation pane, under Virtual private cloud, choose Route tables.
2. For each identified NAT gateway route table, verify that it contains the default route 0.0.0.0/0 or destination public prefix with the internet gateway as the next hop.
3. For each identified route table, verify that it contains a route that directs return traffic from the internet back to the source instance.

Verify return routing from the transit gateway

Complete the following steps:

1. On the Amazon VPC console, in the navigation pane, under Transit gateways, choose Transit gateway attachments.
2. In the search field, enter the egress VPC ID.
3. Select the route table ID for the egress VPC.
4. Verify that the route table contains the CIDR block of the original source.

Related information

Using the NAT gateway for centralized IPv4 egress

Introducing VPC Flow Logs for AWS Transit Gateway