0

I have "VPC-A" with NAT and attached Elastic IP address. Couple of services are running inside under load and couldn't be easily moved.

Also I have "VPC-B" with own NAT for subnet and, of course, with other Elastic IP address.

A peering connection is already set between two VPC, so services inside can talk to each other.

First EIP address is whitelisted by third-party services so I can do requests to their API from VPC-A.

In the VPC-B I have a new service that must do similar requests to those API, but EIP in this VPC is not whitelisted.

I tried to route all outgoing traffic to the peering connection instead of NAT, but AWS doesn't support this (I can set this rule in a route table but it won't work).

Is it possible to share somehow one EIP between two VPC in a way when all outgoing requests will flow through it?

I'm thinking about Reverse Proxy, but maybe some other options are available?

kivagant
  • 123
  • 1
  • 1
  • 6

1 Answers1

2

A reverse proxy is almost the only possible solution for this. You can't natively share any kind of gateway device across a peering connection, but a reverse proxy is straightforward.

You could also do it with a pair of EC2 instances, but it's some rather creative and advanced configuration... one on each side of the peering connection and OpenVPN or another type of tunnel between them. On the network without the EIP, configure the instance on its own subnet like a NAT instance, with the appropriate VPC route table pointing to it but with its internal routes sending traffic from the VPC over the tunnel. On the EIP side, NAT the traffic to use the private IP of the instance as its masquerade source.

Michael - sqlbot
  • 22,658
  • 2
  • 63
  • 86