- Newest
- Most votes
- Most comments
Yes, this kind of setup is achievable using AWS components. To create a central routing point for your distributed network, you can use AWS Transit Gateway along with other AWS networking services. Here's an overview of how you can set up this architecture:
- Central VPC (192.168.2.0/24):
- Set up a Transit Gateway in this VPC
- Create a NAT Gateway for outbound internet traffic
- Keep the existing Virtual Private Gateway for the S2S VPN connection to the Partner Network
- For other VPCs and networks:
- Connect the Private VPC (10.1.0.0/24) to the Transit Gateway
- Set up a new S2S VPN connection from your On-Prem network (10.2.0.0/24) to the Transit Gateway
- Configure AWS Client VPN (10.5.0.0/24) and associate it with the Transit Gateway
- Routing:
- Configure Transit Gateway route tables to direct traffic between all connected networks
- Update VPC route tables to send traffic destined for other networks to the Transit Gateway
- Configure the NAT Gateway in the Central VPC to handle outbound internet traffic for all connected networks
- Security:
- Use Network ACLs and Security Groups to control traffic flow between networks
- Implement AWS Network Firewall for additional security if needed
This setup allows you to centralize routing through the Transit Gateway in your 192.168.2.0/24 VPC. The Transit Gateway can route traffic between all connected networks, including the Partner Network (via the existing S2S VPN), other VPCs, your on-premises network, and Client VPN users. The NAT Gateway in the central VPC can be used for internet-bound traffic from all connected networks.
Remember to configure appropriate route tables in the Transit Gateway, VPCs, and on-premises networks to ensure proper traffic flow. Also, make sure to set up necessary security groups and network ACLs to control access between different networks.
This architecture provides a scalable and flexible solution for your distributed network setup, allowing for easy expansion and management of multiple network connections.
Sources
Connect your VPC to remote networks using AWS Virtual Private Network - Amazon Virtual Private Cloud
AWS Site-to-Site VPN single and multiple VPN connection examples - AWS Site-to-Site VPN
Using NAT Gateways with multiple-Amazon VPCs at scale | Networking & Content Delivery
AWS Client VPN connection and traffic flow handling simplified | AWS re:Post
answered 2 years ago
Relevant content
- AWS OFFICIALUpdated 4 years ago
But this setup is only NATing Internet Traffic and not the VPN Traffic to 192.168.1.0/24, right? So if I'm doing a ping from 10.1.0.0 to 192.168.1.0 the 10.1.0.X IP will appear as source IP of my ping on the 192.168.1.0/24 side of my VPN connection and won't be accepted as only traffic from 192.168.2.0/24 is allowed.
Is it your requirement to hide the origin of all the connections towards 192.168.1.0/24 behind 192.168.2.0/24? Technically, the solution that'd be transparent to all parties would be to route the native IP ranges between all the participants and use the transit gateway's route tables, possibly network ACLs, and on-premises firewall rules, rather than VPN security associations, to control who can talk to whom. Both approaches are possible but different in their implementation, so this would be best to clarify first.
Thanks for your reply, Leo. Yes, I need to hide the origin towards 192.268.1.0/24 behind 192.168.2.0/24. Those two networks are given by my business partner, he's only accepting traffic from 192.168.2.0/24 and I'd not even know if there is an IP range overlap between his networks and my networks.