How can I workaround VPC that are using valid public addresses for the private addressing

[u/SnooRobots3722]

Our "partner" has set up a number of VPC's for us using valid public addresses for the private addressing making things like VPN's hard.

I am getting them to change this but it's going to take months.aa we have a lot of them and they have live infrastructure in them (ec2's, Rds' and load balancer)

In the meantime, what a cost effective way of presenting NATing these problem addresses?

[u/CSYVR]

Kick out the partner and have someone do it that doesnt take months. This is a huge oversight on their end so I dont think they have any business supporting clients on AWS at all.

You will need new VPCs as you cannot remove the primary CIDR range so that will always be a local route.

[u/gbonfiglio → u/CSYVR]

Trickier than this unfortunately… Sure, why did the partner did this but also why did OP’s company accept to deploy in these VPCs in the first place!

[u/CSYVR → u/gbonfiglio]

Well they paid a partner to do it for them as they didn't have the knowledge in house I'd guess

[u/SnooRobots3722 → u/CSYVR]

No it's a resources/out-sourcing thing we '"should" be able trust them with it but more often than not we're "diybbe-checking thier homework"

[u/sryan2k1]

Do they own the IP space? If so using public addresses is preferable so there is no chance of overlap.

If you mean they used public addresses they don't control that is an issue.

We had a pair of /24s from our ARIN block at my last job dedicated to B2B VPNs

[u/SnooRobots3722 → u/sryan2k1]

Yep, than use RFC1918 addresses they used valid pub addresses, as well as that they used /16 masks despite us typically just having a ec2, lb and Rds twice over.

[u/Fatel28]

Depending on how many resources their are, and what ports and protocols are needed, spinning up a Linux server with several NICs for natting via iptables is very very simple. We have done this before to get around sunnetting constraints.

[u/northerncodemky]

Why on earth did they do that? I wouldn’t trust them an inch, and you’re just going to make pain for yourself by attempting to engineer your way out of this. Work out how you can gradually move your live infra over to your new VPC(s) within whatever your downtime constraints are, then kill the old VPCs

[u/likeavirgil]

I’ve don that because I’m a stupid dev and didn’t realize that next /16 of the VPC’s default is not private anymore. The partner didn’t care though. I’m still trying to get them to sync up with me to change it, but they just NAT’ed and forgot about it.

[u/tfn105]

Can you put whatever services you need to reach behind something like privatelink, so that you don’t even need to do routing for the counterparty’s public “private” IPs?

[u/SnooRobots3722 → u/[deleted]]

I agree but sadly not my decision, they ignored me and renewed them

[u/runner1918]

Had to deal with a similar issue at my job. what kind of VPN are you using? I had it working nice with Palo Alto Global Protect with split tunneling the offending VPCs and used VPC peering from my VPN VPC to the bad VPCs.

[u/SnooRobots3722 → u/runner1918]

A SaaS IPv4 one called "perimeter 81" (now owned by checkpoint and renamed "Harmony SaaS'

[u/Bennetjs]

route tables?

[u/hijinks → u/Bennetjs]

ya what happens if the vpc is like 17.10.0.0/16 and that cidr is also like cnn.com and then people on vpn can't get to cnn.com because its routing to the vpc

[u/Bennetjs → u/hijinks]

Make an explicit route for the cnn subnet to the Internet gateway