<p>VPC peering does not support transit traffic.</p>

<p><a href="https://docs.aws.amazon.com/vpc/latest/peering/invalid-peering-configurations.html#edge-to-edge-vgw" rel="nofollow noreferrer">Unsupported VPC Peering Configurations</a> described several scenarious that are not supported.</p>

<p>This case is not specifically mentioned, but is implicit from the other limitations.  </p>

<p>Note also that it is impossible to fully configure the setup you are attempting, because when you route a given destination towards a remote VPC via a peering connection, there is no route table in the target VPC that is applicable to that traffic. Only the instance subnets are available.  Route tables apply only to subnets, and the default route table only applies to subnets without an explicitly assigned route table -- not to incoming traffic from a peering connection.  There is no way to route this traffic back to your instance.</p>

<p>This is why Hardware VPN, Direct Connect, and NAT devices are not available across peering, </p>

<p>A <a href="https://aws.amazon.com/blogs/aws/aws-solution-transit-vpc/" rel="nofollow noreferrer">Transit VPC</a> is not what you have described.  These use AWS VPC Hardware VPN connections on the spokes and an EC2-based <em>router</em> at the hub to terminate the tunnels... and the transit routing between the tunnels is done within the instance -- not by the VPC network infrastructure.</p>

CC BY-SA 4.0
2018-10-26T01:06:54.703Z
2018-10-26T01:06:54.703Z
Michael - sqlbot
<p>I am setting up a VPN Server to move all resources behind VPN on AWS, which includes moving multiple VPCs.</p>

<p>The simple setup is:</p>

<p>I have a separate VPC (<code>VPC1</code>) running VPN Server and another VPC (<code>VPC2</code>) with an EC2 machine.</p>

<p>Let's assume the following CIDRs for VPCs &amp; VPN.</p>

<ul>
<li>VPC1: 10.1.0.0/16</li>
<li>VPC2: 10.2.0.0/16</li>
<li>VPN: 10.8.0.0/24</li>
</ul>

<p>Everything is working fine within VPC1.</p>

<p>Now I have enabled VPC Peering between  <code>VPC1</code> &amp; <code>VPC2</code>, but I am not able to access EC2 machine running in <code>VPC2</code> unless I mask the VPN CIDR as following.</p>

<pre><code>iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
</code></pre>

<p>But doing so, I lose the source IP of the request.  All requests are forwarded as requested by VPN machine.</p>

<p>Let me know if any other information/clarification is required.</p>

CC BY-SA 4.0
2018-10-25T15:15:52.220Z
What are the security group rules for the EC2 machines in VPC2 and what are the network ACL on VPC2 ?
Tensibai
CC BY-SA 4.0
2018-10-25T16:53:02.310Z
SGs are allowing traffic from both CDIR `10.1.0.0/16` & `10.8.0.0/24` in VPC2  and ACL are allowing all traffic.  So far I have investigated, it's the issue with VPC Peering, machines in VPC2 are able to receive requests but unable to respond.
Dhirendra
CC BY-SA 4.0
2018-10-25T20:21:46.957Z
I assume vpc2 route table has no route toward 10.8.0.0?
Tensibai
CC BY-SA 4.0
2018-10-26T09:06:07.767Z
Yes, that's the problem.
Dhirendra
<amazon-web-services><aws-vpc><vpn>
Communication between VPCs and a transit VPC hosting VPN Server without Masking source IP
Dhirendra
# Communication between VPCs and a transit VPC hosting VPN Server without Masking source IP

(Asked by: username_0 on 2018-10-25)

I am setting up a VPN Server to move all resources behind VPN on AWS, which includes moving multiple VPCs.
The simple setup is:
I have a separate VPC (VPC1) running VPN Server and another VPC (VPC2) with an EC2 machine.
Let's assume the following CIDRs for VPCs & VPN.

VPC1: 10.1.0.0/16
VPC2: 10.2.0.0/16
VPN: 10.8.0.0/24

Everything is working fine within VPC1.
Now I have enabled VPC Peering between  VPC1 & VPC2, but I am not able to access EC2 machine running in VPC2 unless I mask the VPN CIDR as following.
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

But doing so, I lose the source IP of the request.  All requests are forwarded as requested by VPN machine.
Let me know if any other information/clarification is required.

**Tags:** amazon-web-services, aws-vpc, vpn

> **Comments:**
> **username_1**: What are the security group rules for the EC2 machines in VPC2 and what are the network ACL on VPC2 ?  
> **username_0**: SGs are allowing traffic from both CDIR `10.1.0.0/16` & `10.8.0.0/24` in VPC2  and ACL are allowing all traffic.  So far I have investigated, it's the issue with VPC Peering, machines in VPC2 are able to receive requests but unable to respond.  
> **username_1**: I assume vpc2 route table has no route toward 10.8.0.0?  
> **username_0**: Yes, that's the problem.  

---

## 1 answers

### Answer by username_2 on 2018-10-26. Score: 1 | Accepted answer

VPC peering does not support transit traffic.

[Unsupported VPC Peering Configurations](https://docs.aws.amazon.com/vpc/latest/peering/invalid-peering-configurations.html#edge-to-edge-vgw) described several scenarious that are not supported.

This case is not specifically mentioned, but is implicit from the other limitations.

Note also that it is impossible to fully configure the setup you are attempting, because when you route a given destination towards a remote VPC via a peering connection, there is no route table in the target VPC that is applicable to that traffic. Only the instance subnets are available. Route tables apply only to subnets, and the default route table only applies to subnets without an explicitly assigned route table -- not to incoming traffic from a peering connection. There is no way to route this traffic back to your instance.

This is why Hardware VPN, Direct Connect, and NAT devices are not available across peering,

A [Transit VPC](https://aws.amazon.com/blogs/aws/aws-solution-transit-vpc/) is not what you have described. These use AWS VPC Hardware VPN connections on the spokes and an EC2-based *router* at the hub to terminate the tunnels... and the transit routing between the tunnels is done within the instance -- not by the VPC network infrastructure.


---

