Intermittent issues connecting from a AWS Client VPN to a VPC Peering connection?

0

Hello, I'm seeing something weird and am looking for suggestions of places I should continue to look.

VPC A (10.1.0.0/16) is peered to VPC B (10.91.0.0/16) via a VPC Peering Connection. This connection is working perfectly for instances in VPC A's Subnet A (10.1.4.0/22).

We have an AWS Client VPN Endpoint in VPC A:

  • Client VPN IP Range: 10.90.0.0/22
  • Target Subnet Association: Subnet A (10.1.4.0/22)
  • Authorization Rules to allow access to 10.1.0.0/16 and 10.91.0.0/16
  • VPN Route Table set to 10.1.0.0/16 and 10.91.0.0/16

Visual depiction of the networking issue

Now for the weird part / question. The VPN is only able to connect to Instance B sometimes! I've disconnected and reconnected from the Client VPN Endpoint 21 times, and it's worked for 16 of those attempts:

  • The VPN IPs for working attempts: 10.90.1.2 (x6), 10.90.1.3, 10.90.1.34 (x7), 10.90.1.35
  • The VPN IPs for failed attempts: 10.90.0.2 (x3), 10.90.0.37 (x2)

So this leads me to notice that the AWS Client VPN seems to only be able to access the VPC Peering connection when it gives the client VPN an IP address in the 10.90.0.0/24 sub-range!?

We don't have any networking in VPC that does anything regarding the 10.90.x.x range so I believe this is an issue on the client-side with the AWS official VPN client. Nothing appears to be different with the local routing between when it works and doesn't work.

Any help would be greatly appreciated! Thanks!

已提问 1 年前399 查看次数
2 回答
1
已接受的回答

The issue seems to have resolved itself! 🫠

已回答 1 年前
profile picture
专家
已审核 11 天前
profile picture
专家
已审核 10 个月前
0

Can not see any obvious error above, but details on VPC B are bit limited. Have you followed these steps when configuring this https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/scenario-peered.html

profile picture
专家
Kallu
已回答 1 年前
profile picture
专家
已审核 10 个月前
  • Thanks for taking a look. VPC B is maintained by a PaaS company and we have no visibility into it. However, my understanding is that all the traffic it sees should be coming from the subnet IPs (10.1.4.0/22).

    And yeah, I did all the steps in that article above.

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则