If you have servers running in different AWS Regions, you may need to allow the workloads on those servers to communicate privately.
For example, an application running in Hyderabad might need to communicate with a database running in Sydney using private IPs.
In this how-to, I'll show you how I peered two VPCs in different AWS Regions and connected them using VPC Peering.
Architecture
Assume for this lab that the following architecture is required to be configured:
Region A
Hyderabad
vpc-a-peering-connection (CIDR: 10.0.0.0/16)
subnet: 10.0.1.0/24
Region B
Sydney
vpc-b-peering-connection (CIDR: 10.1.0.0/16)
subnet: 10.1.1.0/24
Make sure that the CIDR ranges do not overlap on the VPCs as you can't peer VPCs with overlapping CIDRs
1. Creating the VPCs and instances
I first proceeded to create the VPCs and launched instances in them
- Navigating to Hyderabad region, I created a vpc-a-peering-connection VPC, public subnet, internet gateway, and a route table. Then I launched a simple Ubuntu EC2 instance in the region
Our region A VPC is created:
The public subnet that I created in Hyderabad region:
The Internet Gateway attached to my Hyderabad VPC:
I then switched to Sydney region and created similar resources in that region as well
The Sydney VPC is created:
The subnet in Sydney region:
The Internet Gateway attached to my Sydney VPC:
For this lab, I launched my EC2 instances in public subnets so that they can be easily accessed for testing. The VPC peering connection does not require the subnet to be public or VPC to have an Internet Gateway
At this point, a ping from the Hyderabad instance to the Sydney instance will fail because there is no route between the two VPCs yet.
2. Creating the peering connection
Now, I proceeded to create the peering connection
I navigated to VPC Dashboard in Hyderabad region, clicked Peering connections, and created a new one
I gave it a name VPC-A to VPC-B, chose my vpc-a-peering-connection as the Requester, and another region as Accepter and Sydney as the region
I chose the vpc-b-peering-connection as the accepter VPC and clicked create
The peering connection request was sent and is awaiting approval:
3. Accepting the connection
Switching to Sydney region, I navigated to Peering connections and accepted the request:
You can now see that the peering connection is active. The next thing to do is to update the route tables
4. Updating the route tables
I navigated to Route Tables and selected the route table associated with the subnet where I launched my EC2 Instance
I added a route to the Sydney VPC:
Destination: 10.1.0.0/16
Target: Peering Connection (selected the PCX created earlier)
I did the same thing in the Sydney region to route traffic back to Hyderabad:
Destination: 10.0.0.0/16
Target: Peering Connection
This route table in Hyderabad now has a route to the Sydney VPC via the peering connection:
The Sydney route table now has a route back to the Hyderabad VPC
5. Updating the security groups
The route tables are now updated, but we also need to allow ICMP traffic in the security groups for the ping test to work.
In the security group of my EC2 instance in Hyderabad region, I updated the Inbound rules to explicitly allow All ICMP - IPv4 from the source 10.1.0.0/16:
(Note: In the above image, there is a TCP rule from another lab. For ICMP traffic, we need the All ICMP - IPv4 inbound traffic rule)
Similarly, in the security group in Sydney, I updated the Inbound rules to allow All ICMP - IPv4 from the source 10.0.0.0/16:
I explicitly allowed the inbound ICMP rules in Sydney. If you have the default outbound rule (All traffic - 0.0.0.0/0) as Allow, there is no need to add an outbound rule for this ping test
6. Testing the connection
I then SSH'd back into my instance in Hyderabad region and did a ping to the private IP address of the instance in Sydney region. It worked after updating the security group:
Now, the two instances can communicate with each other over the AWS network via private IPs
Things to note
You can't establish a VPC Peering connection between VPCs with overlapping IPv4 or IPv6 CIDR blocks
VPC Peering is not transitive. If VPC A is peered with VPC B, and VPC B is peered with VPC C, VPC A cannot communicate with VPC C through VPC B. You need a separate peering connection between A and C. If you have many VPCs, AWS Transit Gateway can provide a centralized way to connect them.
Now you know how to configure inter-Region VPC peering. The peering connection provides the path between the VPCs, but you still need the correct route table entries and security group rules on both sides.
Top comments (0)