- Newest
- Most votes
- Most comments
Hello.
Is it my understanding that RDS in VPC2 cannot be accessed from VPC1 via VPN?
It seems that the RDS security group allows connections from the CIDR of VPC2, but I thought that if I was connecting from VPC1, I might need to allow the CIDR of VPC1.
Routes have been added in the route table of each vpc to route from each VPC CIDR to the peering connection and the RDS security group allows connections from VPC 2 however I cannot connect to the RDS instance when I am on the VPN.
To successfully connect to the RDS instance in VPC 2 from VPC 1 via the VPN server in VPC 1, here are some considerations:
- The VPN server that you are connected to should NAT the IP address of the clients connecting to the VPN server to its own private IP address. This is required as VPC peering doesn't support transitive routing.
- The security group of the RDS should either allow traffic/connections from the VPN server's private IP/security group or VPC 1's CIDR.
- On the VPN Server, make sure you have a route for the CIDR of VPC 2 pointing to the gateway address (first address of the subnet of the VPN server). This will ensure that VPC route table is referenced when the traffic is being forwarded to VPC 2 via the peering connection.
Thanks for your help. I can confirm that 1 & 2 are in place. Re point 3, I have a route in the route table for the VPN VPC for VPC2 CIDR pointing at the peering connection between VPC 1 & 2. Is this what you mean or should there be an additional route for the VPC 2 CIDR?
Point 3 refers to routing within the VPN server and not the VPC route route table where you define the peering routes. VPN server internally should be able to forward the traffic received from the client & destined for VPC 2 CIDR to the gateway address.
Additionally, I assume that the Source/destination check network interface attribute for the VPN server is disabled as you have mentioned earlier that a similar setup works while connecting to a documentDB in VPC 3.
You can enable VPC flow logs in VPC 1 and VPC 2 to troubleshoot further or open a support case with our Support team to help with the troubleshooting.
Also ensure you have created the routes on your VPN so that your client knows how to get to VPC 2
The problem in my case was a specific setting on the VPN server accessed through the UI which required a list of private subnets - I needed to add the CIDR of VPC2 and restart the server for this to take affect. Thanks all for your help
Relevant content
- asked 7 months ago
AWS OFFICIALUpdated 2 years ago- AWS OFFICIALUpdated 3 months ago
- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 2 years ago
Thanks but the rds security group already allows connections from the vpn instance security group
In the case of VPN, I think you will not be able to connect even if you refer to the security group of the VPN instance in the RDS security group. So please try allowing CIDR and see if you can connect.
Thanks - I have tried also adding the VPC1 CIDR to the allowed input of the RDS security group but unfortunately I am still unable to connect