Transit Gateway with Public IPs for VPN

Question

I'm seeking clarification on public IP routing behavior within an AWS Transit Gateway configuration.

Scenario:
My environment consists of a central Network Account VPC connected to multiple production VPCs via Transit Gateway. Each production VPC hosts a Network Load Balancer (NLB) with both public and private IP addresses.
My goal is to allow clients connected to the Network Account VPN to access the NLBs using their public IP addresses.

Questions:
1. Expected Behavior: Can public IP addresses of NLBs within production VPCs be routed through the Transit Gateway to the appropriate VPC attachment based on static routes configured in the Transit Gateway route table?
2. Troubleshooting: If the answer to question 1 is yes, why wouldn't traffic destined for the public IPs of the NLBs reach their intended targets when routed through the Transit Gateway?

Additional Information:
- Network Account VPC CIDR block (e.g., 10.0.0.0/16).
- Example production VPC CIDR block (e.g., 10.1.0.0/16).

Expected Outcome:
I aim to understand the expected behavior of public IP routing within a Transit Gateway setup and any potential limitations.
This information will assist in determining the most suitable solution for client access to the NLBs in my environment.

I checked the documentation sections on "How transit gateways work" and "Transit Gateway route tables" but would like further clarification on public IP routing specifically.

Accepted Answer

The answer to question (1) is no. Public/Elastic IP addresses can only be associated with resources that are in the VPC where the Internet Gateway is attached.

What you can do is have a NLB or ALB in an externally-facing VPC and then send traffic to other workload VPCs across Transit Gateway. Think carefully about doing this as it will increase the cost of your solution (because the traffic has to be processed by Transit Gateway). Instead, I'd recommend keeping the targets for the load balancer within the same VPC where the load balancer is - this also makes using auto-scaling groups much simpler.

To answer a side question which is kind of implied above: You can absolutely have networks with public IP addresses that are connected via Transit Gateway - because Transit Gateway doesn't really care what IP addressing scheme that you use. But you can't do what you suggest and bring traffic in from the internet in this way because the Internet Gateway does a 1:1 translation of a Public/Elastic IP (which is advertised on the internet as being available in the AWS network) to a private IP address within the VPC.

Answer

Hello.

In order to communicate with a public IPv4 address via a Transit Gateway, I think it is necessary to communicate with a public IPv4 address via a NAT Gateway, etc.  
I think the configuration described in the following document will be helpful.  
https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-nat-igw.html

To communicate with NLB's public IP address, you need to communicate with the public network once.  
This means that you will need to NAT from your private IPv4 address to your public IPv4 address.  
Therefore, if going through TransitGateway, communication to public IPv4 must be routed to the subnet where the NAT Gateway is located.

Transit Gateway with Public IPs for VPN

Relevant content