AWS Site-to-Site VPN问题：AWS可通本地，本地无法访问AWS

环境信息 #

• EC2实例私网IP：172.31.27.40，位于默认VPC（含3个子网）
• 本地端公网IP：1.2.3.4
• 已部署组件：Customer Gateway（绑定本地公网IP）、Virtual Private Gateway（已关联VPC）、Site-to-Site VPN连接，两个隧道状态均为UP

配置详情 #

安全组配置 #

入站规则允许192.168.0.0/24的所有流量，出站规则全放开

IPsec配置（Strongswan） #

conn Tunnel1
auto=start
left=%defaultroute
leftid=1.2.3.4
right=(Outside IP address Tunn1)
type=tunnel
leftauth=psk
rightauth=psk
keyexchange=ikev1
ike=aes128-sha1-modp1024
ikelifetime=8h
esp=aes128-sha1-modp1024
lifetime=1h
keyingtries=%forever
leftsubnet=192.168.0.0/24
rightsubnet=172.31.0.0/16
dpddelay=10s
dpdtimeout=30s
dpdaction=restart
## Please note the following line assumes you only have two tunnels in your Strongswan configuration file. This "mark" value must be unique and may need to be changed based on other entries in your configuration file.
mark=499
## Uncomment the following line to utilize the script from the "Automated Tunnel Healhcheck and Failover" section. Ensure that the integer after "-m" matches the "mark" value above, and <VPC CIDR> is replaced with the CIDR of your VPC
## (e.g. 192.168.1.0/24)
leftupdown="/usr/local/sbin/ipsec-notify.sh -ln Tunnel1 -ll *******/30 -lr ******/30 -m 499 -r 172.31.0.0/16"

路由表配置 #

VPC路由表已添加静态路由：目标192.168.0.0/24，下一跳指向Virtual Private Gateway

测试结果 #

• EC2→本地：连通正常

From EC2:
[root@ip-***** ec2-user]# ping 192.168.0.58
PING 192.168.0.58 (192.168.0.58) 56(84) bytes of data.
64 bytes from 192.168.0.58: icmp_seq=1 ttl=64 time=7.82 ms
64 bytes from 192.168.0.58: icmp_seq=2 ttl=64 time=7.84 ms
64 bytes from 192.168.0.58: icmp_seq=3 ttl=64 time=7.76 ms
64 bytes from 192.168.0.58: icmp_seq=4 ttl=64 time=10.8 ms

• 本地→EC2：目标主机不可达

From On prem:
root@****:/home/utente# ping 172.31.27.40
PING 172.31.27.40 (172.31.27.40) 56(84) bytes of data.
From 169.254.**** icmp_seq=1 Destination Host Unreachable
From 169.254.**** icmp_seq=2 Destination Host Unreachable
From 169.254.**** icmp_seq=3 Destination Host Unreachable
From 169.254.**** icmp_seq=4 Destination Host Unreachable

排查步骤 #

• 检查本地端路由：确认本地VPN网关/路由器已配置172.31.0.0/16的静态路由，下一跳为IPsec隧道；本地子网192.168.0.0/24主机的默认网关需指向该VPN网关。
• 核实EC2安全组绑定：确认目标EC2实例确实绑定了允许192.168.0.0/24全流量入站的安全组（规则配置正确，但需检查实例绑定关系）。
• 排查本地NAT规则：避免本地设备将192.168.0.0/24的源地址转换为公网IP，导致AWS返回流量无法匹配VPN隧道。
• 检查IPsec策略匹配：在本地VPN网关执行ipsec statusall，确认发往172.31.0.0/16的流量是否匹配Tunnel1的策略并被封装。
• 确认VPC路由表关联：EC2所在子网必须关联包含192.168.0.0/24→VPG路由的路由表，防止流量走Internet网关。
• 本地主机路由验证：在执行ping的本地主机上运行ip route get 172.31.27.40，确认流量指向正确的VPN网关；运行arp -a检查网关可达性。

内容的提问来源于stack exchange，提问作者Fabio