Lightsail VPC peering not creating connection despite enabled status in us-west-2

Question

Customer reports that Lightsail VPC peering shows as enabled with green checkmark in Lightsail console, but no actual peering connection appears in the VPC console. EC2 instance in default VPC (CIDR 172.31.0.0/16) cannot establish connectivity to Lightsail instance (private IP 172.26.4.95) on port 3306. Connection test using "nc -zv 172.26.4.95 3306" times out. Customer has attempted multiple troubleshooting steps including disabling and re-enabling VPC peering multiple times. Default VPC is confirmed to exist and is properly configured. Lightsail firewall rules are correctly configured to allow connections from 172.31.0.0/16 on port 3306. No CIDR conflicts have been detected. Issue appears to be a service-level problem where VPC peering connection is not being created despite the enabled status indicator in the Lightsail console.

--AMAZON Q CHAT TRANSCRIPT--
Customer: how the ec2 instance can access the Lightsail instance via private IP? For example, 172.26.4.95
Amazon Q: I'll help you understand how your EC2 instance can access the Lightsail instance via private IP. Let me first gather information about your current resources and then provide guidance on establishing this connectivity.Based on the information I've gathered, I can explain how your EC2 instance can access the Lightsail instance via private IP. However, there are some important limitations and requirements to consider.

## Current Connectivity Challenges

The main challenge is that **EC2 instances and Lightsail instances operate in different VPCs by default**, which means they cannot directly communicate using private IP addresses without establishing proper network connectivity.

## Solutions for Private IP Connectivity

### Option 1: VPC Peering (Most Common Solution)

**Step 1: Enable VPC Peering for Lightsail**
1. Open the Lightsail console
2. Choose **Account** from the top navigation menu
3. Select the **Advanced** tab
4. Find your AWS region and click **Enable VPC peering**

This creates a peering connection between your Lightsail VPC and your **default VPC** in the same region.

**Step 2: Move EC2 to Default VPC or Set Up Cross-VPC Connectivity**
Since Lightsail can only peer with the default VPC, you have two options:
- Move your EC2 instance to the default VPC, or
- Set up VPC peering between your custom VPC and the default VPC

**Step 3: Configure Security Groups**
- Update the Lightsail firewall to allow traffic from your EC2 instance's private IP range
- Update your EC2 security groups to allow outbound traffic to the Lightsail instance

### Option 2: Transit Gateway (For Complex Scenarios)

If you need more complex routing between multiple VPCs, you can use AWS Transit Gateway to connect:
- Lightsail VPC (via peering with default VPC)
- Your custom VPC where the EC2 instance resides
- Any other VPCs you need to connect

### Option 3: Migrate to EC2 (Long-term Solution)

For maximum networking flexibility, consider migrating your Lightsail workload to EC2 instances within your existing VPC. This eliminates the networking constraints entirely.

## Important Limitations

1. **Lightsail VPC Peering Restrictions**: Lightsail can only peer with the default VPC in the same AWS account and region
2. **No Transitive Routing**: VPC peering is not transitive, so you need direct connections between VPCs that need to communicate
3. **CIDR Block Conflicts**: Ensure the IP ranges don't overlap between your VPCs

## Verification Steps

After setting up VPC peering, you can test connectivity:

```bash
# From your EC2 instance, test connectivity to the Lightsail instance
ping 172.26.4.95

# Test specific port connectivity
telnet 172.26.4.95 [port_number]

## Next Steps

Since I couldn't retrieve the specific details of your EC2 instance, could you please confirm:
1. Which AWS region both instances are in?
2. Is your EC2 instance in the default VPC or a custom VPC?
3. What specific service or port do you need to access on the Lightsail instance?

This information will help me provide more specific configuration guidance for your setup.
Customer: What is my default VPC in the region us-west-2?
Amazon Q: I'll help you find your default VPC in the us-west-2 region.Your default VPC in the us-west-2 region is:

**VPC**
- **Name**: 
- **CIDR Block**: 172.31.0.0/16
- **DNS Support**: Enabled
- **DNS Hostnames**: Enabled

## Default VPC Subnets:
1. **us-west-2a**: subnet-1 (172.31.16.0/20)
2. **us-west-2b**: subnet-2 (172.31.32.0/20) 
3. **us-west-2c**: subnet-3 (172.31.0.0/20)

All subnets have auto-assign public IP enabled.

## Important for Your Lightsail Connectivity:

Since your Lightsail instance has the private IP **172.26.4.95**, and your default VPC uses the CIDR block **172.31.0.0/16**, there's **no IP address conflict** between the networks, which is good for VPC peering.

To establish connectivity between your EC2 instance and your Lightsail instance:

1. **Enable VPC peering** between Lightsail and your default VPC 
2. If your EC2 instance is in one of the other VPCs , you'll need to either:
   - Move it to the default VPC, or
   - Set up VPC peering between your EC2's VPC and the default VPC

Would you like me to help you determine which VPC your EC2 instance is currently in, or guide you through the VPC peering setup process?
Customer: root@ip-172-31-37-185:~# nc -zv 172.26.4.95 3306
nc: connect to 172.26.4.95 port 3306 (tcp) failed: Connection timed out
Amazon Q: The connection timeout indicates that your EC2 instance cannot reach the Lightsail instance on port 3306 (MySQL/MariaDB). Let me help you troubleshoot this connectivity issue.Based on the network analysis and your connection test, the issue is clear: **VPC peering between your Lightsail instance and your default VPC is not established**. Here's what's happening and how to fix it:

## Root Cause
Your EC2 instance (IP 172.31.37.185) is in the default VPC with CIDR 172.31.0.0/16, but your Lightsail instance (172.26.4.95) is in a separate Lightsail VPC. Without VPC peering, these networks cannot communicate directly.

## Solution Steps

### Step 1: Enable VPC Peering for Lightsail
1. Open the **Lightsail console**
2. Click **Account** in the top navigation
3. Select the **Advanced** tab
4. Find **us-west-2** region
5. Click **Enable VPC peering**

This will create a peering connection between your Lightsail VPC and your default VPC.

### Step 2: Verify VPC Peering
After enabling, check if peering was successful:
1. Open the **VPC console**
2. Go to **Peering connections**
3. Look for a connection between Lightsail VPC and default VPC
4. Status should be "Active"

### Step 3: Configure Lightsail Firewall
In your Lightsail instance firewall settings:
1. Add a rule allowing **MySQL/Aurora (port 3306)**
2. Source: **172.31.0.0/16** (your default VPC CIDR)

### Step 4: Check EC2 Security Group
Ensure your EC2 instance's security group allows outbound traffic:
- **Type**: MySQL/Aurora
- **Port**: 3306
- **Destination**: 172.26.4.95/32 or 172.26.0.0/16

### Step 5: Test Again
After VPC peering is active, retry your connection:

nc -zv 172.26.4.95 3306

## Alternative Quick Test
You can also test basic connectivity first:
```bash
# Test if you can ping the Lightsail instance
ping 172.26.4.95

# If ping works, then test the specific port
telnet 172.26.4.95 3306
```

## Expected Timeline
- VPC peering typically takes 1-2 minutes to become active
- Route propagation may take an additional few minutes

re:Post Agent · Accepted Answer

This appears to be an issue with the VPC peering connection between your Lightsail VPC and the default VPC in us-west-2. While the Lightsail console shows VPC peering as enabled (with a green checkmark), the actual peering connection may not be properly established or configured.

Here are several troubleshooting steps to resolve this issue:

1. **Check route tables**: Even though VPC peering is enabled in Lightsail, verify that the route tables in your default VPC have been updated with routes to the Lightsail VPC CIDR (172.26.0.0/16). The route should point to the VPC peering connection (pcx-*). You may need to manually add a route in your default VPC's route table to direct traffic destined for the Lightsail VPC to the peering connection.

2. **Verify peering connection status**: Use the AWS CLI to confirm the actual peering status:
```
aws lightsail is-vpc-peered --region us-west-2
```
This should return `{"isPeered": true}` if peering is actually active.

3. **Security groups and network ACLs**: Ensure that both the security groups for your EC2 instance and any network ACLs in the default VPC allow outbound traffic to the Lightsail instance's CIDR range on port 3306.

4. **Disable and re-enable peering**: Since you've already tried disabling and re-enabling VPC peering multiple times, this may indicate a deeper issue. However, sometimes waiting a few minutes after re-enabling can help as route propagation takes time.

5. **IPv6 considerations**: If IPv6 is enabled on your Lightsail instance, be aware that VPC peering for Lightsail has a known limitation where IPv6 traffic may not properly route through the VPC peering connection. The IPv6 routes are not automatically added to the route tables when VPC peering is enabled in Lightsail.

6. **Check for transitive routing**: Remember that VPC peering does not support transitive routing. If your EC2 instance is not in the default VPC but in another VPC that's peered with the default VPC, traffic won't flow through to the Lightsail instance.

If these steps don't resolve the issue, this could be a service-level problem with the Lightsail VPC peering functionality. In that case, you may need to contact AWS Support for further assistance.  
**Sources**  
[Lightsail IPv6 VPC Peering | AWS re:Post](https://repost.aws/questions/QUxOLN7HTMTVOXI8QwxNal_w/lightsail-ipv6-vpc-peering)  
[Lightsail examples using AWS CLI - AWS SDK Code Examples](https://docs.aws.amazon.com/code-library/latest/ug/cli_2_lightsail_code_examples.html)  
[Troubleshoot a VPC peering connection - Amazon Virtual Private Cloud](https://docs.aws.amazon.com/vpc/latest/peering/troubleshoot-vpc-peering-connections.html)  
[VPC peering - Amazon Virtual Private Cloud Connectivity Options](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/vpc-peering.html)  
[prerequisites to ensure vpc peering | AWS re:Post](https://repost.aws/questions/QUkDFWtBUlQfyETl1h5Z2skw/prerequisites-to-ensure-vpc-peering)

Lightsail VPC peering not creating connection despite enabled status in us-west-2

Current Connectivity Challenges

Solutions for Private IP Connectivity

Option 1: VPC Peering (Most Common Solution)

Option 2: Transit Gateway (For Complex Scenarios)

Option 3: Migrate to EC2 (Long-term Solution)

Important Limitations

Verification Steps

Expected Timeline

Add your answer

Relevant content