VPC Peering connection via Client VPN

0

Hello, I have a question regarding the configuration of Client VPN Endpoint and VPC peering. I came across a statement on the documentation page that says, 'In full tunnel mode, access to the peered VPC is allowed by default.' However, I would like to confirm if any additional configuration, such as adding routes to the destination VPC in the route tables of the subnets associated with the Client VPN Endpoint, is required. Could you please provide clarification on this matter? https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/scenario-peered.html

Is it possible to connect just by making a VPC peering connection on the following page? https://docs.aws.amazon.com/vpc/latest/peering/create-vpc-peering-connection.html

asked a year ago465 views
2 Answers
2
Accepted Answer

Yes, you need to have routing between 2 VPCs via peering connection (both ways) to be able to connect things in VPC B via Client VPN. In your linked document about setting up VPC peering, in each scenario the last step is setting up routing. So that instructions should work.

profile picture
EXPERT
Kallu
answered a year ago
profile picture
EXPERT
reviewed a year ago
  • Thank you for your response. If you happen to know, could you please explain the reasons for the different configurations between Split Tunnel mode and Full Tunnel mode?

0

Difference between full and split tunnel modes is explained in https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/split-tunnel-vpn.html

By default, when you have a Client VPN endpoint, all traffic from clients is routed over the Client VPN tunnel. When you enable split-tunnel on the Client VPN endpoint, we push the routes on the Client VPN endpoint route table to the device that is connected to the Client VPN endpoint. This ensures that only traffic with a destination to the network matching a route from the Client VPN endpoint route table is routed over the Client VPN tunnel.

So it is about if all your traffic goes to VPN tunnel or just those packets that are targeted to networks advertises you. Downside of full -mode is you need to provide route to internet and might not be able to reach addresses in your local (think of office environment) network.

Ps. If you think this answering your question, please click "accept" the answer. Thanks in advance!

profile picture
EXPERT
Kallu
answered a year ago
profile picture
EXPERT
reviewed a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions