0

I am having trouble connecting between servers in a multi-region network I’m setting up in AWS, as not all servers are able to be reached from any point in the network.

I’m connecting a VPC (A) in eu-central-1 to another one (B) in eu-southeast-1 via an openvpn tunnel, with the second VPC being connected via ClassicLink to an EC2-Classic (EC2) nodes. This connection is made via a couple of peering servers, peering-a in VPC A and peering-b in VPC B. Users connect via openvpn to VPC A via a openvpn server vpnserver-a.

The network diagram is like this: 

+---------+   +---------+   +---------+   +----+
|user     |   |VPC A    |   |VPC B    |   |EC2 |
|172.20/16+---+172.29/16+---+172.31/16+---+10/8|
+---------+   +---------+   +---------+   +----+
           VPN           VPN       ClassicLink

The problem is that I’m not able make any of this connections:

  • user to any node in EC2
  • any node in VPC A to any node in EC2
  • any node in EC2 to any node in VPC A

Connections from user to VPC A & B, and between VPCs A & B are working fine.

I suspect there is a problem in the routing, but I have not been able to solve it.

The routing is set up so:

  • vpnserver-a publishes routes 172.29/16, 172.31/16 and 10/8 to the user (openvpn config file)
  • peering-a publishes routes 172.31/16 and 10/8 to VPC A (openvpn config file)
  • peering-b publishes routes 172.29/16 and 172.20/16 to VPC B (openvpn config file)
  • route table in VPC A routes 172.31/16 and 10/8 to peering-a (AWS VPC subnet routing table)
  • route table in VPC B routes 172.29/16 and 172.20/16 to peering-b (AWS VPC subnet routing table)

Network ACLs are open to all traffic between those subnets. Security groups are also setup to accept connections.

I made some (basic) packet inspection with tcpdump to try to understand if the routes are working with this results: - Attempting to connect from node-a in VPC A to node-ec2 in EC2, I can see packets going through peering-a and peering-b, but not reaching node-ec2 - Attempting to connect from node-ec2 to node-a, I cannot even see packets reaching peering-b

So I suspect the routing in ClassicLink involves additional configuration I am not aware of.

How can I setup the missing routes? Is this even possible?

Thanks!

RogerFC
  • 344
  • 1
  • 2
  • 11
  • What VPN are you using between VPC-A and VPC-B? Is that just a vpc peering? – ALex_hha Dec 14 '17 at 12:23
  • An OpenVPN tunnel. I cannot use ‘native’ vpn peering due to not being transitive and being a multi-region connection. I have not researched the brand new multiregion peering as it is not supported at least in frankfurt. – RogerFC Dec 14 '17 at 17:33

1 Answers1

1

ClassicLink doesn't support access to anything outside the VPC.

You notice there is no route table that applies to traffic from ClassicLink -- the routes from there back to your instances in this VPC are implicit, and thus there is no way to deliver the foreign traffic back to your "peering-b" instance.

Strictly speaking, the following does not specifically say that it won't work, because the VPN connections they refer to are the VPN connections provided by VPC's Hardware VPN service, not connections you engineer with your own instance...

ClassicLink does not support transitive relationships out of the VPC. Your linked EC2-Classic instance will not have access to any VPN connection, VPC endpoint, or Internet gateway associated with the VPC. Similarly, resources on the other side of a VPN connection, or an Internet gateway will not have access to a linked EC2-Classic instance.

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/vpc-classiclink.html#classiclink-limitations

...however, the implications are there, and the fact that the ClassicLink machines don't have a configurable VPC route table that handles their traffic coming towards the VPC means you there's not technically even a way to attempt to configure your VPC to work the way this scenario requires.

Michael - sqlbot
  • 22,658
  • 2
  • 63
  • 86
  • Strangely, the same document mentions something apparently contradictory: "If you have a VPC peering connection between two VPCs [...] you can extend the VPC peering connection to enable communication between the EC2-Classic instances and the instances in the VPC on the other side of the VPC peering connection". Then in another [document](http://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/peering-configurations-classiclink.html) it explains how to do it for 'native' VPC peering. – RogerFC Dec 14 '17 at 23:06
  • 1
    I think it would work only with VPC peering and wouldn't work with openvpn. Will try to check in test environment – ALex_hha Dec 14 '17 at 23:55
  • @RogerFC that's a good observation but isn't directly contradictory because while native peering allows ClassicLink instances to see past the peering connection, it doesn't let them transit the peered VPC to the addresses routed to that initial VPN instance, because again there is no route table that the traffic from the ClassicLink instances will follow. Peering is never transitive... even if A peers natively to B and B peers natively to C, A still has no access to C. – Michael - sqlbot Dec 15 '17 at 03:57