VPN
4 posts tagged VPN.
Client VPN connected, authenticated, and reaching nothing
A Client VPN endpoint has its own route table and its own authorization rules, and a destination has to be in both before a connected user can reach it. Add one without the other and the tunnel is up, the client has an address, and every packet goes nowhere — with a different silence depending on which one you forgot.
Networking6 minThe Site-to-Site VPN tunnel that waits to be called
By default, AWS never initiates a Site-to-Site VPN tunnel. Your device has to. So a tunnel that only carries traffic AWS originates — monitoring, a scheduled job, a backup pull — comes up, idles, drops, and stays down until something on your side sends a packet. The fix is one setting that most people have never seen, and it requires IKEv2.
Networking6 minSmall transfers work, large ones hang, and the ICMP that would explain it was never sent
Path MTU Discovery depends on the device that drops an oversized packet sending an ICMP back. On AWS, which devices do that is documented per attachment type — and a Site-to-Site VPN is not one of them. Jumbo-frame instances talking to on-premises over a VPN see the classic hang, and no security group rule in the world will produce the ICMP that was never generated.
Networking8 minOn-premises cannot reach a NAT Gateway through a virtual private gateway
The same design works with a Transit Gateway and does not work with a VGW. It is one sentence in the documentation, and it decides whether centralised egress for on-premises traffic is possible at all.
Networking6 min