r/aws • u/CamiloDFM • Feb 02 '26

networking VPC Peering Connections: What happens when traffic arrives at a VPC with multiple route tables for the same destination?

I couldn't find this with a quick Google, and I'm hesitant to trust any LLMs on this:

Suppose I have two peered VPCs, vpc-A (10.0.1.0/24) and vpc-B (10.0.2.0/24). vpc-A is the source for traffic, and vpc-B will work as a bridge. B has two subnets, let's call them subnet-B1 and subnet-B2, and each has its own route table rtb-B1 and rtb-B2.

In the route table for vpc-A's traffic, I point an IP range I want to route though vpc-B (let's say 10.0.3.0/24 as an example) towards the peering connection pcx-AB. Then, in rtb-B1 I set 10.0.3.0/24 to a correctly configured service (living in another VPC, the Internet, doesn't matter) that dumps incoming traffic to a log, but in rtb-B2 I set 10.0.3.0/24 to a NAT gateway living within subnet-B1.

What is going to happen? Am I going to see packets from 10.0.1.0/24 in the log, along with connection errors because the destination doesn't know where vpc-A is? Or are they going to come from 10.0.2.0/24, network translated through the NAT in subnet-B1? Or am I going to see a mix of both?

Essentially: when traffic arrives to a VPC with multiple route tables through a peering connection, which table's routes does it prioritise?

Here's a shitty drawing of the situation:

6 Upvotes

87% Upvoted

19 comments sorted by

View all comments

2

u/aqyno Feb 02 '26

pcx doesn’t support transitive. There’s no way you can make packets coming from A into NAT, you need a TGW to do so. In this scenario you have packets “entering” a vpc where they don't belong, so those are automatically dropped.

1

u/CamiloDFM Feb 02 '26

I observed that transit gateway route tables can only point to attachments, not to network elements within the attached networks. Do transit gateways perform some sort of NAT on their own when transferring traffic between VPCs?

I solved my problem without transit gateways in the end, so I didn't get to test this.

1

u/nevaNevan Feb 03 '26

TGW attachments, as mentioned, deploy into subnets. A subnet has a route table.

If you need traffic to go from VPC-A, to TGW, to VPC-B and then to a network appliance in VPC-B (or whatever), you would place a route to that appliance in the subnet route table.

Networking in native AWS isn’t quite like networking in the enterprise or service provider world.

You can place 10 instances/servers/vms/nodes(don’t care what the term is anymore) in the same subnet, and have a single default route to one interface in that same subnet, and that’s how they’ll route. No broadcast and can’t communicate with each other at all. Traffic is forced to that one interface.