How to route Internet traffic through the IPSec site-to-site VPN to AWS?

Hi Adam Vu 

Please try to use packet capture utility and check traffic- https://community.sophos.com/kb/en-us/123189

Please also check tracert  to public IP from the user system and share the output.

Hey Keyur and LuCar Toni

The packet capture utility shows ping to 8.8.8.8 violation because of firewall rule.

So I added 2 firewall rules:

- LAN_to_VPN: Source: LAN, Local Subnet --> Dest: VPN, Any

- VPN_to_LAN: Source: VPN, Any --> LAN, Local Subnet

Still can ping only the IP inside AWS VPC, cannot ping the Internet.

Now the packet capture utility shows ping to 8.8.8.8 forwarded because of the new 1st rule.

The result of traceroute is stop at the gateway of the LAN:

$ traceroute 8.8.8.8

1  192.168.0.1  (192.168.0.1)  3.455 ms  1.390 ms  1.258 ms

2  *  *  *

3  *  *  *

What firewall rule should I add more? Or the problem may be at the AWS site?

Hi Adam Vu 

If the traffic is getting forwarded and not getting any reply packet please try to capture the packet at the AWS side and check whether the packets are being received at AWS site or not. No further firewall rules are needed. Please verify at the gateway level.

The AWS VPC does not allow transit traffic. Cannot push Internet traffic to the VPN Gateway

The AWS VPC does not allow transit traffic. Cannot push Internet traffic to the VPN Gateway