Routing internet traffic via VPC from remote Site-to-Site VPN Network

Question

Is it possible to route internet traffic from a remote on-premise network, via an AWS site-to-site VPN into a VPC, and out through the VPC's Internet Gateway as a means of providing the remote network with Internet access?  I'm using a StrongSwan customer gateway on the remote network, and a Transit Gateway into the VPC.

Answer

Hello,

Yes, it is possible. You would need a NAT gateway for the internet egress.

This pattern is described in this link along with routing:

https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-nat-igw.html

Please note that from TGW perspective, there are only attachments and in this case it does not matter if the spoke attachment is a VPC or a VPN, so you can disregard the fact that the example includes only VPCs.

The flow would look like below, not detail but would give you an idea:

On-premises network <== VPN ==> TGW --> VPC (NAT gateway & IGW) --> Internet

Hope this helps.

Routing internet traffic via VPC from remote Site-to-Site VPN Network

Relevant content