Route over VPN / NAT?

Question

Hello, what we're trying to do is force a certain /32 which is a public IP over our site-to-site VPN we have with a vendor. I have this route added on the site-to-site VPN tunnel itself and have tried adding the /32 route to our route table with the destination of our VGW and it does not seem to like that.

Currently we have our servers sitting behind a Load Balancer and they seem to NAT out of the IP that is assigned to the Load Balancer and the vendor requires the IP we source from, to be whitelisted. They DID however, offer us to NAT from a /32 private address. The problem is our VPC subnet is a /16. Is it possible to create a /32 and route traffic destined for that public IP to that NAT gateway and have that NAT gateway route over the VPN?

or do we figure out a way to push only traffic destined for that public IP over the VPN while utilizing the public IP of our load balancer?

Gary Mclean · Answer

1. Which route table did you add the /32 to?
2. Are your servers in a public or private subnet?

re:Post Agent · Answer

Yes, it is possible to route traffic from a specific IP address over your site-to-site VPN while using NAT. Here's how you can approach this:

1. Create a new subnet in your VPC with a smaller CIDR block (e.g., /28) that includes the /32 private IP address the vendor offered for NAT.

2. Deploy a private NAT gateway in this new subnet. This NAT gateway will be assigned the /32 private IP address.

3. Update your route tables:
   - In the route table for your workload subnets (where your servers are), add a route for the vendor's public IP (/32) pointing to the new NAT gateway.
   - In the route table for the new subnet with the NAT gateway, add a route for the vendor's public IP (/32) pointing to your Virtual Private Gateway (VGW) where the VPN tunnel terminates.

4. Ensure that the VPN tunnel's configuration includes a route for the new subnet's CIDR block.

5. On the vendor's side, they should configure their VPN endpoint to route traffic destined for your new NAT gateway's IP through the VPN tunnel.

This setup will allow traffic destined for the vendor's public IP to be routed through the NAT gateway and then over the VPN, appearing to come from the /32 private IP address they specified. All other traffic will continue to use your existing routing, including traffic through your load balancer.

It's important to note that this configuration uses the NAT gateway's private IP, not a public IP. The NAT gateway will only use its public IP (Elastic IP) when routing traffic to the internet through an Internet Gateway in the same VPC.

If you absolutely need to use a public IP as the source over the VPN, you would need to add a small block of public IPs (that you own) to your VPC and use those for the NAT gateway. However, this is more complex and usually not necessary for private VPN connections.

Remember to test thoroughly after implementation to ensure all routing behaves as expected.  
**Sources**  
[Route Egress Traffic through NAT Gateway to VPN Gateway | AWS re:Post](https://repost.aws/questions/QURB28_CKLRJ-yT3dKy07Y-Q/route-egress-traffic-through-nat-gateway-to-vpn-gateway)  
[Public IP as source over transit gateway | AWS re:Post](https://repost.aws/questions/QUxW820yBTR1CDHxxZh1Fh0g/public-ip-as-source-over-transit-gateway)  
[NAT gateway use cases - Amazon Virtual Private Cloud](https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateway-scenarios.html)  
[Example routing options - Amazon Virtual Private Cloud](https://docs.aws.amazon.com/vpc/latest/userguide/route-table-options.html)

Route over VPN / NAT?

Add your answer

Relevant content