Communication between VPCs and a transit VPC hosting VPN Server without Masking source IP

Question

I am setting up a VPN Server to move all resources behind VPN on AWS, which includes moving multiple VPCs.

The simple setup is:

I have a separate VPC (VPC1) running VPN Server and another VPC (VPC2) with an EC2 machine.

Let's assume the following CIDRs for VPCs & VPN.

• VPC1: 10.1.0.0/16
• VPC2: 10.2.0.0/16
• VPN: 10.8.0.0/24

Everything is working fine within VPC1.

Now I have enabled VPC Peering between VPC1 & VPC2, but I am not able to access EC2 machine running in VPC2 unless I mask the VPN CIDR as following.

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

But doing so, I lose the source IP of the request. All requests are forwarded as requested by VPN machine.

Let me know if any other information/clarification is required.

Answer 1

VPC peering does not support transit traffic.

Unsupported VPC Peering Configurations described several scenarious that are not supported.

This case is not specifically mentioned, but is implicit from the other limitations.

Note also that it is impossible to fully configure the setup you are attempting, because when you route a given destination towards a remote VPC via a peering connection, there is no route table in the target VPC that is applicable to that traffic. Only the instance subnets are available. Route tables apply only to subnets, and the default route table only applies to subnets without an explicitly assigned route table -- not to incoming traffic from a peering connection. There is no way to route this traffic back to your instance.

This is why Hardware VPN, Direct Connect, and NAT devices are not available across peering,

A Transit VPC is not what you have described. These use AWS VPC Hardware VPN connections on the spokes and an EC2-based router at the hub to terminate the tunnels... and the transit routing between the tunnels is done within the instance -- not by the VPC network infrastructure.