Why can't some of my on-premises subnets reach AWS resources through a Site-to-Site VPN?

Short description

The following reasons can cause some on-premises subnets not to reach Amazon VPC resources through a Site-to-Site VPN connection:

• Route table entries are incorrect or missing in the VPC or on the VPN connection.
• The customer gateway device doesn't advertise routes through Border Gateway Protocol (BGP).
• Security group or network access control list (network ACL) rules don't include the affected subnets.
• The encryption domain on the customer gateway device doesn't include the affected subnet CIDRs.
• On-premises routing or firewall rules don't forward the affected subnet traffic through the VPN connection.
• The CIDR ranges between the affected subnets and VPC subnets overlap.

Resolution

Check VPC route table configuration

For virtual private gateway VPNs

Complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, choose Route tables.
3. Select the route table that's associated with your target subnet.
4. On the Routes tab, confirm that a route exists for the on-premises CIDRs with the target set to your virtual private gateway.
5. If the route is missing, then turn on route propagation to automatically populate VPN routes.

For AWS Transit Gateway VPNs

Complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, choose Route tables.
3. Select the route table that's associated with your target subnet.
4. On the Routes tab, confirm that a route exists for the on-premises CIDRs that point to the transit gateway.

For a dynamic VPN, confirm that you activated propagation on both the VPN attachment and VPC attachment in the transit gateway route tables.

For a static VPN, confirm that the route exists on the VPC attachment route table. Then, confirm that VPC routes propagate on the VPN attachment route table.

For more information, see Why can't I connect to Amazon VPC when I use a Site-to-Site VPN that terminates on a transit gateway?

Review security group and network ACL rules

Complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, choose Security groups.
3. Select the security group that's attached to your AWS resource.
4. On the Inbound rules tab, check whether a rule explicitly allows traffic from the on-premises subnet CIDRs.

Note: A working subnet has an existing rule that includes its CIDR range. The non-working subnet CIDR isn't in the rule's range.

Check VPN routes

For a static VPN that terminates on a virtual private gateway

Complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, choose Site-to-Site VPN connections.
3. Select your VPN connection, and then choose the Static routes tab.
4. Check whether you set the on-premises subnet CIDRs as static routes on the VPN connection.
5. On your customer gateway device, check whether a reverse route for the VPC CIDRs exists. The route must point to the virtual tunnel endpoint.

For a dynamic VPN

Take the following actions:

• Check that your customer gateway device advertises the on-premises subnets to the AWS peers.
• Confirm that the prefixes appear in your customer gateway BGP route table.

Check the encryption domain configuration

If the encryption domain on your customer gateway device doesn't include the affected subnet CIDRs, then the device doesn't send that traffic through the VPN tunnel. Add the on-premises subnet CIDRs to the encryption domain configuration on your customer gateway device.

Note: By default, Site-to-Site VPN supports a unique Security Association (SA) pair for each VPN endpoint. If your policy-based VPN defines multiple encryption domains, then a new connection for the subnet can cause an existing working connection to drop. For more information, see How do I troubleshoot connection problems between an AWS VPN endpoint and a policy-based VPN?

Check your on-premises routing and firewall rules

Take the following actions:

• Check whether your on-premises router has routes that direct the subnet traffic toward the VPN tunnel endpoint.
• For a static VPN, check whether a reverse route for the VPC CIDR exists on your customer gateway device. The route must point to the VPN tunnel endpoint.
• Check whether your on-premises firewall rules allow the subnets to send traffic to the VPC CIDR range. The working subnets might have explicit allow rules that the affected subnets don't have.

Check for overlapping CIDR ranges

Routing conflicts can occur when the on-premises subnets overlap with VPC CIDR ranges. Check whether they overlap.

If you use a Site-to-Site VPN CloudHub, then check whether the on-premises subnets overlap with CIDRs from another VPN connection on the same virtual private gateway. Remote sites that you connect through the same virtual private gateway can't have overlapping IP address ranges. If multiple VPN connections advertise overlapping prefixes, then the virtual private gateway routes traffic to the incorrect destination based on route priority rules.

Related information

Why can't I connect to my on-premises network using an AWS Site-to-Site VPN?