My office network is
10.25.0.0/16. I have a VPC in Amazon that's
10.100.0.0/16, and I have a VPN established between the office and the VPC using Amazon's Virtual Private gateway. This connection works as expected - traffic to 10.100.0.0 connects fine.
I have a separate VPC (legacy stuff) in
10.30.0.0/16, and I've setup openswan between
10.30.0.0 so they can speak to each other, and that works (I can ssh between the two networks).
My problem is that I want to connect from the
10.25.0.0 network to
10.30.0.0 network THROUGH the
10.100 network. I've set all the appropriate routing rules in the office firewall (SonicWall NSA2400, SonicOS 5.9) but as far as I can tell traffic isn't leaving the SonicWall. When I do a packet capture on the sonicwall, packets destined for
10.30.x.x show as "Consumed" or "dropped" with zero "forwarded." I don't understand what "consumed" is either, but that's a separate issue.
I've tried everything I can think of - there are no ACLs or Firewall rules blocking traffic. Traffic to 10.100 and 10.33 are routed the exact same way (over the VPN interfaces) but traffic to 10.100 gets forwarded while traffic to 10.33 doesn't.
Here's what a packet capture for an SSH attempt to 10.100 shows:
--File Index : 1.-- --241 packets captured.-- -----Statistics------------ Number Of Bytes Failed To Report: 0 Number Of Packets Forwarded : 53 Number Of Packets Generated : 0 Number Of Packets Consumed : 137 Number Of Packets DROPPED : 51 Number Of Packets Status Unknown: 0 *Packet number: 1*
Here's what I get when I SSH to 10.33:
--58 packets captured.-- -----Statistics------------ Number Of Bytes Failed To Report: 0 Number Of Packets Forwarded : 0 Number Of Packets Generated : 0 Number Of Packets Consumed : 13 Number Of Packets DROPPED : 45 Number Of Packets Status Unknown: 0
What am I missing to allow it to forward traffic to 10.33.0.0 over the Office-AmazonVPC tunnel? According to everything I've read this should work but I appear to be missing something.
Edit #2: I followed this exact guide. As I said, it works for the 10.100 network but not the 10.30 network through the same interface: http://www.sonicwall.com/app/projects/file_downloader/document_lib.php?t=TN&id=339&dl=1
Edit #3: Traffic within the VPC is routing correctly, so if there's some magic incantation you need to do to let it route traffic from our office LAN I'd love to know what it is. We have a static route inside the VPC to tell it that the 10.25.0.0/16 traffic should go over the VPGW, and all the other routes for 10.30.0.0/16 are correctly forwarding to the OpenVPN instances.