I am setting up a VPN Server to move all resources behind VPN on AWS, which includes moving multiple VPCs.

The simple setup is:

I have a separate VPC (VPC1) running VPN Server and another VPC (VPC2) with an EC2 machine.

Let's assume the following CIDRs for VPCs & VPN.

  • VPC1:
  • VPC2:
  • VPN:

Everything is working fine within VPC1.

Now I have enabled VPC Peering between VPC1 & VPC2, but I am not able to access EC2 machine running in VPC2 unless I mask the VPN CIDR as following.

iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

But doing so, I lose the source IP of the request. All requests are forwarded as requested by VPN machine.

Let me know if any other information/clarification is required.

  • What are the security group rules for the EC2 machines in VPC2 and what are the network ACL on VPC2 ?
    – Tensibai
    Commented Oct 25, 2018 at 15:15
  • SGs are allowing traffic from both CDIR & in VPC2 and ACL are allowing all traffic. So far I have investigated, it's the issue with VPC Peering, machines in VPC2 are able to receive requests but unable to respond.
    – Dhirendra
    Commented Oct 25, 2018 at 16:53
  • I assume vpc2 route table has no route toward
    – Tensibai
    Commented Oct 25, 2018 at 20:21
  • Yes, that's the problem.
    – Dhirendra
    Commented Oct 26, 2018 at 9:06

1 Answer 1


VPC peering does not support transit traffic.

Unsupported VPC Peering Configurations described several scenarious that are not supported.

This case is not specifically mentioned, but is implicit from the other limitations.

Note also that it is impossible to fully configure the setup you are attempting, because when you route a given destination towards a remote VPC via a peering connection, there is no route table in the target VPC that is applicable to that traffic. Only the instance subnets are available. Route tables apply only to subnets, and the default route table only applies to subnets without an explicitly assigned route table -- not to incoming traffic from a peering connection. There is no way to route this traffic back to your instance.

This is why Hardware VPN, Direct Connect, and NAT devices are not available across peering,

A Transit VPC is not what you have described. These use AWS VPC Hardware VPN connections on the spokes and an EC2-based router at the hub to terminate the tunnels... and the transit routing between the tunnels is done within the instance -- not by the VPC network infrastructure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.