Routing/forwarding to onprem site



Here my setup:

  • one on prem site (range
  • one AWS Org with two account A & B, with a VPC peering between VPC-A ( and VPC-B (
  • Wireguard VPN setup between vm1 (on prem) and vmA-1 (VPC-A)
  • VPC-A route: - -> vmA-1 - -> peering - -> local - -> igw
  • VPC-B route: - -> peering - -> local - -> igw
  • IP src/dest check is disable on vmA-1

From an ec2 on any subnet in VPC-A, I can reach vms on prem. From an vm on prem, I can reach ec2s in VPC-A and VPC-B. From ec2 on any subnet in VPC-B, I can reach vmA-1. From ec2 on any subnet in VPC-B, I cannot reach vms on prem.

Did I miss something (obviously yes) ? Is there any src/dest check that need to be disable as well at the peering, route table level ?

Thanks for sharing your ideas !

asked a year ago291 views
1 Answer

This setup will not work, you can only target the VPCA CIDR over the VPC peering connection. You would need to NAT the traffic on vmA-1 to make this work the way you have it setup now. Using a TGW in place of the VPC peer will allow you to route the traffic the way you are trying to over the VPC peer as TGWs provide transitive routing and the TGW attachment subnets in the VPCA can redirect the traffic to vmA-1. You could also setup the VPN to the Transit Gateway directly or from the on-prem vm1 to VGWs on both VPCs or to EC2 instances in both VPCs.

answered a year ago
  • Thanks a lot for confirming that something was wrong in my setup ! I'll give a try to the TGW and review my peering setup.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions