Confirm approach of using transit gateways with direct connect to allow access from AWS VPC to OnPrem (with overlapping CIDR)
The problem summarised: ECS services inside VPC A (AWS) need to access API Endpoints in VPC D (onprem) with the caveat both VPCs have identical CIDR ranges.
We created intermediary VPC B on AWS side and VPC C (as a proxy) on the onprem side and connect with direct connect (this is confirmed working as an ec2 host in VPC B can access the api endpoint of VPC D.)
We previously attempted to use VPC peering to connect VPA A with VPC B to get to VPC C.. but realise this won't work as it's not possible to do edge to edge routing with vpc peering.
The solution appears to be using transit gateway meaning routing 10.47.8.0/21 inside VPC A to transit gateway to connect to VPC B, which in turn routes the traffic for 10.47.8.0/21 to a private nat gateway, which connects to direct connect and eventually VPC C, D etc.
Is this the correct solution? Have I missed something or over complicated anything? Any feedback greatly appreciated.
(Lastly, services in VPC A will only access api endpoint in VPC D, there will be no information flow the other way)
Thanks!
- Newest
- Most votes
- Most comments
This pattern is explained in the below whitepaper, see the second section 'How to use Private NAT gateway to provide approved IPs for on-premises network'
One way of connecting two VPCs with overlapping IP addresses together - and especially in this case where one VPC (A) only ever calls the other (D) - is PrivateLink. Well worth considering to eliminate all the other complexity.
For more information: https://aws.amazon.com/blogs/networking-and-content-delivery/connecting-networks-with-overlapping-ip-ranges/
this is an interesting idea!
My problem with this solution is Private Link will only help us connect to AWS Services or a network load balancer which doesn't make sense to implement if we only have a single fixed endpoint in 10.47.9.0/24
Consider VPC B & C are already connected with direct connect and the virtual private gateway
I've checked all the use cases from https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/use-case-examples.html
Relevant content
- Accepted Answerasked 9 months ago
- Accepted Answer
asked 5 years ago - asked 2 months ago
- asked 8 months ago
AWS OFFICIALUpdated 5 months ago- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 2 years ago
thankyou, but your solution assumes the transit gateway (TGW) is connected directly to the direct connect gateway (DCG), which it isn't.
In my setup, the DCG is directly connected to a virtual private gateway which is in turn connected to VPC B.
The problem I face if I try to modify my solution to the whitepaper you suggested are that it's not possible to connect TGW to DCG if it's already attached to a virtual private gateway (VPGW), if I disconnect the VPGW it won't accept that the DCG already has virtual interfaces configured.