How do I configure NAT on my VPC CIDR for traffic that traverses a Site-to-Site VPN connection?

Short description

AWS VPN doesn't provide a managed option to apply NAT to VPN traffic.

To apply NAT to VPN traffic, take one of the following actions:

• Use a software-based VPN solution from AWS Marketplace to manually configure NAT.
• Manually configure NAT on an Amazon Elastic Compute Cloud (Amazon EC2) Linux instance that runs a software-based VPN solution and iptables.

Important: To resolve the IP address overlap issue, you must have a solution for both the source and destination NAT. Private NAT gateways can perform source IP address NAT, but they can't perform both source and destination NAT. However, NAT instances can handle source and destination NAT at the same time.

Resolution

The following example resolution shows NAT configuration that uses iptables on an Amazon EC2 instance that runs a software-based VPN. In the example, the following two VPCs simulate a VPN connection:

• VPC A uses an AWS-managed VPN endpoint and represents the cloud workload side.
• VPC B uses an EC2 software VPN instance and represents the on-premises customer gateway device that performs NAT.

In production, the software VPN instance terminates the IPsec tunnel on-premises. Therefore, the configuration doesn't require an AWS-managed VPN connection.

Note: To use a Private NAT Gateway with Site-to-Site VPN, the translated IP address of the gateway must fall within the on-premises network's allowed CIDR range. For more information, see How can we map entire AWS VPC CIDR to a single IP address using Private NAT Gateway via AWS Site to Site VPN connection. For instructions on how to use a Private NAT Gateway with a Site-to-Site VPN for an allow-listed IP range, see Access your network using allow-listed IP addresses.

Allow VPN traffic

Configure your VPC route table, security groups, and network access control list (network ACL) to allow VPN traffic.

Complete the following steps:

1. In your route table, create a route to direct network traffic to your destination network. Set the elastic network interface as the destination of your software-based Amazon EC2 Linux instance.
2. Confirm that your route table has a default route with a destination of an internet gateway.
3. Update your EC2 Linux instance's security group rules to allow inbound traffic. Use UDP packets on port 500 (ISAKMP) and 4500 (IPsec NAT-Traversal).
4. Turn off the source/destination checks so that the instance can forward IP address packets between your VPN's subnets.

Configure the VPN connection

Configure a Site-to-Site VPN connection. If you don't already have one. You can download Site-to-Site VPN example configuration files.

Then, use your distribution's package manager to install your VPN solution on the EC2 Linux instance.

Note: To use strongSwan as a VPN solution, see vpn-gateway-strongswan on the GitHub website.

Configure the iptables

To configure iptables for the source NAT, run the following sudo iptables command:

sudo iptables -t nat -A POSTROUTING -d your_destination_address_or_CIDR -j SNAT --to-source your_IP_address

Note: Replace your_destination_address_or_CIDR with your destination address or CIDR and your_IP_address with your IP address.

For the destination NAT, run the following sudo iptables command:

sudo iptables -t nat -A PREROUTING -j DNAT --to-destination your_IP_address

Note: Replace your_IP_address with your IP address.

To save your running iptables configuration to a file, run the following sudo iptables-save command:

sudo iptables-save > /etc/iptables.conf

To load your iptables configuration on boot, enter the following line in /etc/rc.local before the exit 0 statement:

sudo iptables-restore < /etc/iptables.conf

To confirm the change, test your Site-to-Site VPN connection.