Intermittent issues connecting from a AWS Client VPN to a VPC Peering connection?

0

Hello, I'm seeing something weird and am looking for suggestions of places I should continue to look.

VPC A (10.1.0.0/16) is peered to VPC B (10.91.0.0/16) via a VPC Peering Connection. This connection is working perfectly for instances in VPC A's Subnet A (10.1.4.0/22).

We have an AWS Client VPN Endpoint in VPC A:

  • Client VPN IP Range: 10.90.0.0/22
  • Target Subnet Association: Subnet A (10.1.4.0/22)
  • Authorization Rules to allow access to 10.1.0.0/16 and 10.91.0.0/16
  • VPN Route Table set to 10.1.0.0/16 and 10.91.0.0/16

Visual depiction of the networking issue

Now for the weird part / question. The VPN is only able to connect to Instance B sometimes! I've disconnected and reconnected from the Client VPN Endpoint 21 times, and it's worked for 16 of those attempts:

  • The VPN IPs for working attempts: 10.90.1.2 (x6), 10.90.1.3, 10.90.1.34 (x7), 10.90.1.35
  • The VPN IPs for failed attempts: 10.90.0.2 (x3), 10.90.0.37 (x2)

So this leads me to notice that the AWS Client VPN seems to only be able to access the VPC Peering connection when it gives the client VPN an IP address in the 10.90.0.0/24 sub-range!?

We don't have any networking in VPC that does anything regarding the 10.90.x.x range so I believe this is an issue on the client-side with the AWS official VPN client. Nothing appears to be different with the local routing between when it works and doesn't work.

Any help would be greatly appreciated! Thanks!

2개 답변
1
수락된 답변

The issue seems to have resolved itself! 🫠

답변함 일 년 전
profile picture
전문가
검토됨 11일 전
profile picture
전문가
검토됨 10달 전
0

Can not see any obvious error above, but details on VPC B are bit limited. Have you followed these steps when configuring this https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/scenario-peered.html

profile picture
전문가
Kallu
답변함 일 년 전
profile picture
전문가
검토됨 10달 전
  • Thanks for taking a look. VPC B is maintained by a PaaS company and we have no visibility into it. However, my understanding is that all the traffic it sees should be coming from the subnet IPs (10.1.4.0/22).

    And yeah, I did all the steps in that article above.

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠