AWS Site-to-site VPN between two cloud providers

Let's go through some troubleshooting steps and potential solutions to help you resolve this issue.

Confirm VPN Connection Status: First, ensure that the VPN connection is actually established. In the AWS console, check the status of your VPN connection. It should show as "UP".

Verify Static Routes: Since you're using static routing, make sure you have correctly configured the static routes on both sides (AWS and Scaleway). The routes should point to the correct CIDR blocks of the remote networks through the VPN connection.

Check Security Groups and Network ACLs: Ensure that the security groups and network ACLs on both sides allow the necessary traffic. You mentioned ICMP, UDP 500, and UDP 4500 are open, but also check for the actual application traffic you're trying to pass through the VPN.

NAT Gateway Configuration: Verify that the NAT Gateway is correctly configured and associated with the private subnets on both sides. Ensure that the route tables for private subnets have a route to the NAT Gateway for internet access.

StrongSwan Configuration: Review your StrongSwan configuration on the bastion host (customer gateway). Make sure it's correctly set up with the right IP addresses, pre-shared key, and encryption settings matching the AWS VPN configuration.

Logging and Monitoring: Enable verbose logging on StrongSwan and check the AWS VPN logs (if available) to see if there are any specific errors or issues being reported.

Test Connectivity Step-by-Step:

First, try to ping from the bastion host to AWS VPN endpoint. Then, try to ping from a private instance in AWS to the bastion host. Next, attempt to ping from the bastion host to a private instance in AWS. Finally, try pinging between private instances on both sides. BGP Consideration: Although you're using static routing, consider if BGP (Border Gateway Protocol) might be a better option for your setup, as it can handle route updates more dynamically.

AWS Support: If you're still having issues, consider reaching out to AWS support. They can provide more specific guidance based on your exact configuration.

If you need more specific guidance, please provide the exact error messages you're seeing or more details about where in the network path the communication is failing. This will help in providing more targeted advice.