AWS: How to Route External Subnet via Direct Connect to a VPC Appliance

Select Language:

If you’re working with a setup where traffic from a 10.x.x.x/8 network comes through AWS Direct Connect into a Virtual Private Cloud (VPC) with 172.x.x.x/16 subnets, there are some key areas to check to resolve connectivity issues.

First, make sure you’re advertising your on-premises network route. The 10.x.x.x/8 prefix needs to be advertised over the Border Gateway Protocol (BGP) session on your Direct Connect virtual interface. Without this, AWS won’t know how to route traffic back to your on-premises network.

Next, examine your VPC route tables. These tables should have entries that direct traffic destined for the 10.x.x.x/8 network to the virtual private gateway connected via your Direct Connect. You can add these routes manually or enable route propagation in your route tables to automatically update as BGP advertisements change.

Security settings are often overlooked but are just as important. Confirm that your security groups and network access control lists (ACLs) allow inbound and outbound traffic for the 10.x.x.x/8 range. If these are too restrictive, traffic may be silently dropped without any clear error messages.

If you are routing traffic to a specific virtual appliance or network interface (ENI), ensure that certain configurations are in place. The route table associated with the subnet should have a route directing the 10.x.x.x/8 traffic to the ENI connected to the appliance. Also, disable source/destination checks on that ENI if it’s performing routing or firewall functions. Make sure the appliance itself is configured to handle the 10.x.x.x/8 network, accepting and routing traffic correctly. Lastly, confirm that return traffic is routed properly so responses can be sent back over the Direct Connect connection.

If your setup uses an appliance for inspecting traffic, double-check that routes are correctly directing relevant traffic to the appliance’s endpoint. The subnet containing this appliance should have routes managing both the incoming 10.x.x.x/8 traffic and the outbound traffic destined for 172.x.x.x/16.

Since you’re not seeing any activity in your flow logs, use VPC Flow Logs to troubleshoot. These logs can help pinpoint where traffic is being dropped or rejected. Also, perform basic network tests—like ping or traceroute—to verify connectivity. Ensure that your appliance is functioning properly and processing traffic as intended.

Consider that the lack of flow log entries suggests traffic might not be reaching your VPC at all. This points primarily to issues with how the BGP routes are advertised or how the virtual private gateway is configured. Reviewing these areas can often reveal the root cause.

If you’re still having trouble, consulting the official AWS guides on routing troubleshooting and inspection firewalls can provide additional insights. Making sure all these aspects are correctly set up can help you establish a reliable connection across your network.

Sources: