Lecture 104: VPN Transitive Routing scenarios
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：09:45
- 来源：Udemy Lecture 26077784
- Slide 数量：7
- 画面切换：00:48、04:04、04:48、05:57、07:01、08:07
扫描说明
逐条检查了 Udemy 页面中的 212 条 Transcript cue，并以每条 cue 对应画面为时间轴逐段扫描全长约 9:45 的视频。依据标题、互联网访问、VPC 对等连接、网关端点、接口端点、经本地网络访问互联网和总结七个独立幻灯片，共划分出 7 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPN 传递路由场景概览
时间范围：00:00–00:48
总结 / Summary
中文
本讲分析站点到站点 VPN（Site-to-Site VPN）和 Direct Connect 接入虚拟私有网关（Virtual Private Gateway, VGW）后的传递路由（transitive routing）行为。重点判断本地网络（on-premises network）经 VGW 进入 VPC 后，能否继续访问互联网、对等 VPC 或 VPC 端点（VPC endpoint）。
English
This lecture examines transitive-routing behavior after Site-to-Site VPN or Direct Connect enters a VPC through a Virtual Private Gateway. The key question is whether traffic arriving from on premises through the VGW can continue to the internet, a peered VPC, or VPC endpoints.
Transcript
00:00 Hello, and welcome to this lecture.
00:01 In this lecture, we are going to see
00:03 some VPN Transitive Routing Scenarios.
00:06 Now, if your corporate data center is connected
00:08 to AWS VPC using site-to-site VPN connection
00:12 via virtual private gateway,
00:15 then if you're sending traffic
00:16 from your on-premise network to AWS,
00:19 now let's see what happens,
00:21 suppose if you want to reach to a peered VPC
00:24 through that virtual private gateway connection,
00:26 or you want to reach to say internet
00:29 via internet gateway on AWS side of the network.
00:32 Now, is that possible or it's not possible?
00:35 So let's look at some of the scenarios
00:37 and that would help us really choose the right answer,
00:40 given a scenario where the traffic will flow
00:42 in that situation or not.
00:44 So let's see few scenarios here.
2. 从 VPN 访问互联网
时间范围：00:48–04:04
总结 / Summary
中文
经虚拟私有网关（VGW）进入 VPC 的本地流量不能直接借助互联网网关（Internet Gateway, IGW）访问互联网，因为 VGW 是网关而不是位于子网中的弹性网络接口（Elastic Network Interface, ENI）。把托管式 NAT 网关（NAT Gateway）放在中间仍不受支持，因为无法调整其内部行为；若改用公有子网中的自管理 NAT EC2 实例（self-managed NAT EC2 instance），管理员可控制转发与路由规则，该路径可以工作。
English
On-premises traffic entering through a VGW cannot reach the internet directly through an Internet Gateway because a VGW is a gateway rather than an Elastic Network Interface in a subnet. Inserting the managed NAT Gateway still does not make the path valid because its behavior cannot be customized. A self-managed NAT EC2 instance in a public subnet can work because its forwarding and routing behavior is under the administrator's control.
Transcript
00:48 Now, this setup is very much what we have seen so far.
00:52 There is a corporate data center and customer gateway,
00:55 and then there is AWS VPC and virtual private gateway
00:58 attached to the VPC.
00:59 And these are connected over site-to-site VPN connection.
01:03 Now on VPC side, you also have IGW attached through IGW.
01:09 You know, you can reach to the internet,
01:11 but now the question is,
01:13 if your traffic is coming from your corporate data center,
01:17 it flows through customer gateway
01:19 to the virtual private gateway,
01:21 can it reach to the internet via this IGW,
01:24 which is attached to your VPC?
01:26 And what we mean that on corporate data center,
01:29 you might not have outbound internet connection,
01:32 but you're trying to reach to the internet
01:34 by going through the VPN tunnel,
01:36 and then from the IGW, is that possible?
01:39 So the short answer is no, that's not possible.
01:43 And there is a reason to that
01:44 because virtual private gateway
01:46 is actually a gateway device,
01:48 it's not ENI which is provisioned by AWS,
01:53 where, because ENI is a part of your VPC,
01:55 it's a part of your subnet.
01:57 That means for the traffic which lands into that ENI,
02:01 follows all the routing rules of your subnet.
02:04 But in this case, VGW is not ENI, it's a gateway
02:08 and that's where it can't route the traffic
02:10 directly from VGW to IGW.
02:13 So in that sense, this is invalid scenario.
02:16 That means you cannot reach to the internet
02:19 via the VGW, remember this.
02:22 Now, moving on, what if now,
02:24 instead of we said that you cannot go directly to the IGW,
02:28 but what if we introduced NAT gateway in between?
02:31 Because you know, if there is a public or a private subnet
02:34 and there is a NAT gateway in a public subnet,
02:36 you can reach to internet, at least from within the VPC.
02:40 Now, that could have been possible if we had more control
02:44 over that NAT device, but in this case,
02:46 NAT gateway is again a managed service
02:48 and it does not allow to change any configuration
02:51 on that NAT device.
02:53 And due to NAT gateway limitations,
02:55 we cannot still reach to the internet
02:58 if the traffic lands to VGW, and then from there,
03:01 we can't really go to the internet via NAT gateway.
03:04 So this is also invalid scenario
03:07 in that case, remember this.
03:10 Okay, now that being said,
03:13 what if I am having my own NAT EC2 instance,
03:17 and then I configure it the way I want?
03:19 Now, if you look at that scenario,
03:21 now you have all the control over the NAT instance
03:24 where you can remove all those restrictions of NAT gateways,
03:27 and of course this NAT instance is in public subnet
03:31 and it follows the routing rules
03:32 what do you define in a public subnet.
03:34 In this case, it is possible
03:36 that whatever traffic comes from your corporate data center
03:39 via the VGW can go to the internet
03:43 via this NAT EC2 instance.
03:45 So remember, for sending the traffic to internet via IGW,
03:50 you can't use internet gateway directly
03:52 or NAT gateway directly,
03:53 but you can have your NAT EC2 instance
03:56 and then that traffic can flow.
03:58 Okay, I hope that is clear.
04:01 Now let's look at some other scenarios as well.
3. VPN 与 VPC Peering
时间范围：04:04–04:48
总结 / Summary
中文
VPC 对等连接（VPC Peering）不支持传递路由（transitive routing）。通过客户网关（Customer Gateway, CGW）和 VGW 到达主 VPC 的流量并非源自主 VPC，因此不能继续穿越对等连接访问另一 VPC；必须为目标网络设计直接连接或改用支持中转的架构。
English
VPC Peering does not support transitive routing. Traffic that reaches the primary VPC through the Customer Gateway and VGW did not originate in that VPC, so it cannot continue across a peering connection to another VPC; a direct connection or a transit-capable architecture is required.
Transcript
04:04 Now, in this case, I have another VPC,
04:07 which is attached to my primary VPC,
04:09 where I'm terminating my VPN connection.
04:12 Now think again, right, here, also, as you know,
04:16 VPC peering does not support the transitive routing.
04:19 That means if traffic is landing into this VPC from outside,
04:24 this traffic cannot flow to the other peered VPC directly,
04:28 unless you are originating that traffic
04:30 here in the primary VPC.
04:33 Now what traffic we are sending again,
04:35 is not originating from this VPC,
04:37 and that means this connection is also not possible.
04:41 So remember that thing.
04:43 Okay, now let's look at some more scenarios
04:46 and then we'll conclude this section.
4. VPN 与 VPC Gateway Endpoint
时间范围：04:48–05:57
总结 / Summary
中文
网关端点（Gateway Endpoint）依靠子网路由表（subnet route table）中的前缀列表（prefix list）把 VPC 内发起的流量送往 Amazon S3 或 DynamoDB。经 VGW 从本地网络抵达的流量并非源自该 VPC，不能把网关端点当作传递下一跳，因此不能通过这种路径访问 S3 或 DynamoDB。
English
A Gateway Endpoint uses a prefix list in a subnet route table to send VPC-originated traffic to Amazon S3 or DynamoDB. Traffic arriving from on premises through the VGW did not originate in the VPC, so it cannot use the gateway endpoint as a transitive next hop and cannot reach S3 or DynamoDB through this path.
Transcript
04:48 Now, what if I have VPC gateway endpoint attached to my VPC?
04:53 And as you know, we covered that
04:54 in a VPC endpoint section through gateway endpoint,
04:58 you can reach to AWS services like S3 and DynamoDB,
05:02 and for using VPC gateway endpoint, of course,
05:04 you need to modify the route table of your subnet, right?
05:07 So that traffic can reach to S3 or DynamoDB
05:09 using the prefix list.
05:12 Now, again, a similar rule applies like VPC peering
05:15 to the VPC gateway endpoint as well.
05:18 Traffic is not originating from this VPC,
05:21 and that's where it can not follow those route tables.
05:24 So in this case as well, this is an invalid scenario.
05:29 This traffic cannot flow through virtual private gateway.
05:32 And if you remember,
05:33 we had covered this scenario
05:35 in VPC endpoint lecture as well.
05:37 We said this is an invalid scenario,
05:39 where traffic is coming from on-premise
05:41 through virtual private gateway, or say VPN connection,
05:43 you cannot reach to AWS services through a gateway endpoint.
05:48 Now things change a little
05:51 when instead of VPC gateway endpoint,
05:53 you are trying to use VPC interface endpoints,
5. VPN 与 VPC Interface Endpoint
时间范围：05:57–07:01
总结 / Summary
中文
接口端点（Interface Endpoint）由 AWS PrivateLink 提供支持，并在选定子网中创建弹性网络接口（ENI）。由于来自本地的流量可以在 VPC 内以 ENI 私有地址为明确目的地，因此能够经 VPN 私有访问 API Gateway、Elastic Load Balancing、Amazon SQS 或客户端点服务（endpoint service）。这正是接口端点与网关端点在该场景中的关键差异。
English
An Interface Endpoint is powered by AWS PrivateLink and creates Elastic Network Interfaces in selected subnets. Because on-premises traffic has an explicit ENI private address as its VPC destination, it can privately access services such as API Gateway, Elastic Load Balancing, Amazon SQS, or customer endpoint services over the VPN. This is the key distinction from a Gateway Endpoint in this scenario.
Transcript
05:57 which are powered by PrivateLink.
05:59 Now, if you remember VPC interface endpoint
06:02 allows you to reach to AWS services endpoints APIs,
06:06 like you can hit the EC2 API's load balancer,
06:10 or you can send a message to the SQS privately
06:13 from your VPC, and this is powered by PrivateLink.
06:17 In that case what happens,
06:18 is this VPC interface endpoint creates ENI,
06:22 Elastic Network Interface into your subnet,
06:25 and through that ENI,
06:27 you can reach to the respective services.
06:30 Now, if you see, I have some destination in my VPC
06:33 where the traffic can land,
06:35 and from there through that ENI,
06:37 I should be able to go to the respective services.
06:40 So in case of interface endpoint,
06:42 it is possible that I can access these services
06:46 from on-premises via the private gateway.
06:49 So this traffic is allowed.
06:52 So that's a difference between
06:53 a gateway endpoint and an interface endpoint
06:56 with respect to transitive routing.
06:57 So hope that is clear.
6. 从 AWS 经本地网络访问互联网
时间范围：07:01–08:07
总结 / Summary
中文
反向场景中，流量从 VPC 发起，经 VGW、VPN 和客户网关（CGW）到达公司数据中心（corporate data center）。管理员完全控制本地 NAT 设备（on-premises NAT）与路由策略，因此只要 CGW 和本地网络允许，该流量可以继续访问互联网或其他第三方网络；这可作为 AWS 侧 NAT 实例或 NAT 网关的替代出口设计。
English
In the reverse direction, traffic originates in the VPC and crosses the VGW, VPN, and Customer Gateway into the corporate data center. Administrators fully control the on-premises NAT device and routing policy, so the traffic can continue to the internet or other third-party networks when the CGW and on-premises routes allow it. This can serve as an alternative egress design to AWS-side NAT.
Transcript
07:01 Now let's take the other way around.
07:04 This is more, we talked about
07:06 a traffic coming from on-premises to AWS,
07:08 but now the other way around,
07:10 the traffic is originating on AWS side of the network.
07:14 And again, through virtual private gateway,
07:16 through customer gateway
07:17 it is reaching to on-premise data center.
07:20 Now, what if I want to reach to internet
07:22 using on-premise NAT devices?
07:24 Now, if you look at this,
07:26 you can completely configure the way you want, right,
07:31 on corporate data center side of the NAT devices.
07:34 So if you allow that in your routing rules for this NAT,
07:37 of course you can reach to the google.com
07:40 or any internet websites.
07:42 So there is no such restrictions.
07:45 That means when a traffic originates from VPC,
07:48 all the routing rules which we configured here would apply.
07:52 And if you want to allow connection to internet,
07:54 allow connection to some other third party networks,
07:56 all that would be possible.
07:58 So this is very well a valid scenario.
08:01 Okay, so that's what I wanted to cover.
08:04 Let's quickly recap what we just talked about.
7. 传递路由结论
时间范围：08:07–09:45
总结 / Summary
中文
从本地网络经 VGW 进入 AWS 时，不能继续通过 VPC 的 IGW、NAT 网关、VPC 对等连接或网关端点；可以访问接口端点（Interface Endpoint），也可以通过公有子网中的自管理 NAT EC2 实例访问互联网。从 AWS 经 CGW 到本地时，则可依据本地路由与 NAT 规则访问互联网或其他网络。实用判断方法是：若流量先落到 VPC 内的 ENI 或 EC2 实例，通常可继续按子网规则路由；若仅在多个网关之间传递，通常不受支持。
English
From on premises through a VGW, traffic cannot continue through the VPC's IGW, managed NAT Gateway, VPC Peering, or Gateway Endpoint. It can access an Interface Endpoint or use a self-managed NAT EC2 instance in a public subnet for internet egress. From AWS through the CGW, on-premises routing and NAT policy determine further reachability. A useful heuristic is that traffic landing on an ENI or EC2 instance can usually follow subnet routing, whereas gateway-to-gateway transit usually is not supported.
Transcript
08:07 So if traffic is originating from your on-premises
08:10 and going to AWS via virtual private gateway,
08:13 then you cannot access internet
08:16 through a VPC attached internet gateway,
08:18 you cannot access internet through a NAT gateway,
08:21 you cannot access peered VPC resources
08:23 through peering connection,
08:25 and you cannot access S3 and DynamoDB
08:27 via the VPC gateway endpoint.
08:30 However, you can definitely access AWS services endpoints
08:36 using interface VPC interface endpoint,
08:39 which is powered by PrivateLink.
08:42 And also you can access internet
08:44 if you're using self-managed NAT instance
08:48 in a public subnet,
08:49 then also you can access internet
08:51 via the virtual private gateway.
08:53 Now, other way round,
08:54 if the traffic is originating from AWS
08:56 and going to customer gateway,
08:58 then you can access whatever traffic you want
09:01 to access on the customer network side of it, right?
09:04 There is no such restrictions.
09:06 So that's about the transitive routing of VPN,
09:11 and this is good to remember all these scenarios
09:14 or at least think in what cases it will be possible.
09:18 So the key is if traffic lands into your VPC that is ENI
09:23 or an EC2 instance on which the traffic force lands,
09:26 then most probably the traffic is allowed.
09:29 If it is just a gateway and then you have
09:31 to route traffic using route tables,
09:33 it won't be allowed,
09:34 that essentially allows or denies the traffic
09:37 which flows through a VPN.
09:39 So that's it about this lecture,
09:41 I hope that is clear, and thank you.
整讲总结 / Overall Summary
中文
VPN 传递路由（VPN transitive routing）并不是默认能力：经虚拟私有网关（VGW）到达 VPC 的本地流量不能再穿越 IGW、托管式 NAT 网关、VPC 对等连接或网关端点。可行的例外包括具有 ENI 的接口端点（Interface Endpoint）和可完全控制的自管理 NAT EC2 实例；反方向从 AWS 进入本地网络后，则由本地 CGW、NAT 与路由策略决定后续可达性。
English
VPN transitive routing is not generally available: on-premises traffic entering a VPC through a VGW cannot continue through an IGW, managed NAT Gateway, VPC Peering, or Gateway Endpoint. Supported exceptions include Interface Endpoints backed by ENIs and a fully controlled self-managed NAT EC2 instance. In the reverse direction, reachability after entering the on-premises network is governed by local CGW, NAT, and routing policy.
返回顶部 ↑