Intermittent issues connecting from a AWS Client VPN to a VPC Peering connection?

0

Hello, I'm seeing something weird and am looking for suggestions of places I should continue to look.

VPC A (10.1.0.0/16) is peered to VPC B (10.91.0.0/16) via a VPC Peering Connection. This connection is working perfectly for instances in VPC A's Subnet A (10.1.4.0/22).

We have an AWS Client VPN Endpoint in VPC A:

  • Client VPN IP Range: 10.90.0.0/22
  • Target Subnet Association: Subnet A (10.1.4.0/22)
  • Authorization Rules to allow access to 10.1.0.0/16 and 10.91.0.0/16
  • VPN Route Table set to 10.1.0.0/16 and 10.91.0.0/16

Visual depiction of the networking issue

Now for the weird part / question. The VPN is only able to connect to Instance B sometimes! I've disconnected and reconnected from the Client VPN Endpoint 21 times, and it's worked for 16 of those attempts:

  • The VPN IPs for working attempts: 10.90.1.2 (x6), 10.90.1.3, 10.90.1.34 (x7), 10.90.1.35
  • The VPN IPs for failed attempts: 10.90.0.2 (x3), 10.90.0.37 (x2)

So this leads me to notice that the AWS Client VPN seems to only be able to access the VPC Peering connection when it gives the client VPN an IP address in the 10.90.0.0/24 sub-range!?

We don't have any networking in VPC that does anything regarding the 10.90.x.x range so I believe this is an issue on the client-side with the AWS official VPN client. Nothing appears to be different with the local routing between when it works and doesn't work.

Any help would be greatly appreciated! Thanks!

2 Answers
1
Accepted Answer

The issue seems to have resolved itself! 🫠

answered a year ago
profile picture
EXPERT
reviewed 14 hours ago
profile picture
EXPERT
reviewed 10 months ago
0

Can not see any obvious error above, but details on VPC B are bit limited. Have you followed these steps when configuring this https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/scenario-peered.html

profile picture
EXPERT
Kallu
answered a year ago
profile picture
EXPERT
reviewed 10 months ago
  • Thanks for taking a look. VPC B is maintained by a PaaS company and we have no visibility into it. However, my understanding is that all the traffic it sees should be coming from the subnet IPs (10.1.4.0/22).

    And yeah, I did all the steps in that article above.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions