I've configured a site-to-site VPN from our firewall (watchguard) to AWS.

Now, how can I connect Account A with Account B? I've already an OpenVPN server in account A to which account B connects (openvpn client).

Does it require AWS VPC Peering? I don't want my VPC to be able to communicate between them.

enter image description here


AWS networking is a bit unusual in the sense that it does not allow for transitive peering (if A is peered with B, and B with C, A can't talk to C) and doesn't allow an account with Direct Connect or VPN connectivity to share that with another account. This is changing with the recent introduction of the Transit Gateway and the (very powerful) Resource Access Manager which allows for some inter-account resource sharing, but by default that's what you're stuck with.

Historically, you could get around this by creating an overlay network using VPNs, which is pretty much what you've done with OpenVPN. However, I would think that what you've shown would not work if you go though the standard AWS VPN gateway from your on-prem firewall, as it will not allow you to configure the tunnel with subnets that don't belong to its own VPC. You may be better off using OpenVPN for all the tunnels, not just between A and B.

  • Unfortunately, watchguard is not compatible with OpenVPN... I have create two VPN STS to my watchguard – Kaymaz Jan 19 at 8:37

If you add the client VPN subnet that you use between A and B, to the A location and the Watchguard firewall, on the site-to-site tunnel, so that the client VPN subnet is allowed to traverse the tunnel by being included as interesting traffic, it should work, barring any odd limitations of AWS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.