Ravindra BagaleCourses & study guides मराठी Track your progress

What Is VPC Peering in AWS and How to Set It Up

By , trainer LinkedIn Last updated:

A VPC is a private network that nothing else can enter unless you open a door (Why a custom VPC). Sometimes two private networks must talk: your app and a partner's database, or your production VPC and a shared-services VPC. Opening the database to the internet is the wrong answer. This chapter explains VPC peering: a private link between two VPCs, the rules it follows (no overlapping CIDRs, not transitive), why you must never accept a peering request you didn't expect, and a full console walk-through: create the peering, accept it, add routes on both sides and open the security groups.

What you'll learn in this class

  • Why two VPCs can't talk by default
  • What VPC peering is
  • Requester, accepter, and the 7-day expiry
  • Routes on both sides, and security group rules
  • Rule 1: CIDRs must not overlap
  • Rule 2: peering is not transitive
  • Why you accept only requests you expect
  • VPC quotas, and the console walk-through

Suppose we are Hotstar, streaming a cricket league. The live scores sit in the league's private database, in the league's own VPC.

  1. Two VPCs are fully separate networks. A server in one can't reach a private IP in the other.
  2. The wrong fix: give the database a public IP and open it to the internet. Now anyone can try to break in.
  3. The right fix: the league peers its VPC with ours. Our app servers reach the database by its private IP, and nothing is exposed to the internet.

Classroom line

Talking between two VPCs privately: that is VPC peering.

Another common case: your own production VPC and a shared-services VPC (monitoring, a build server, a shared database).

Suppose we are Hotstar: reach the league'sdatabase privately Wrong: open the database to the internet Our VPC: App server Internet anyone can try · attackers League VPC: Database, public IP Right: VPC peering, private IP to private IP Our VPC · 10.0.0.0/16 App server 10.0.2.15 pcx-... League VPC · 172.16.0.0/16 Database 172.16.1.20 Nothing is exposed to the internet.

Figure 1. Suppose we are Hotstar and need the league's live scores. Opening the league database to the internet exposes it to everyone. With VPC peering, our app server reaches it by private IP and nothing is public.

2. What VPC peering is

  1. A peering connection is a private link between exactly two VPCs. Its ID looks like pcx-0a1b2c3d4e5f6a7b8.
  2. The VPCs can be in the same account or different accounts, and in the same region or different regions.
  3. Servers talk private IP to private IP. The traffic stays on the AWS network; no internet gateway, NAT or VPN is needed for it.
  4. There is no hourly charge for the peering itself. Data that crosses AZs or regions is charged per GB, like other data transfer.

3. How a peering is set up

Suppose VPC A is 10.0.0.0/16 (ours) and VPC B is 172.16.0.0/16 (the partner's).

  1. Request: the owner of VPC A creates a peering connection to VPC B. A is the requester.
  2. Accept: the owner of VPC B sees it as Pending acceptance and accepts it. B is the accepter. A request that isn't accepted expires after 7 days.
  3. Routes on both sides: A's route table gets 172.16.0.0/16 → pcx-..., and B's route table gets 10.0.0.0/16 → pcx-.... Without the route on either side, the replies have no way back.
  4. Security groups: B's database SG allows 3306 from A's app subnet, for example 10.0.2.0/24.
  5. Now 10.0.2.15 can connect to 172.16.1.20:3306.
Setting up a peering: request, accept, routes,security group VPC A (requester) · 10.0.0.0/16 app 10.0.2.15 172.16.0.0/16 → pcx-... pcx-... Pending 1. A creates a peering request to B. Status: Pending acceptance(expires after 7 days). Active 2. B checks the account ID and CIDR, then accepts. Status: Active.No traffic yet: no routes. VPC B (accepter) · 172.16.0.0/16 db 172.16.1.20 10.0.0.0/16 → pcx-... SG: 3306 from 10.0.2.0/24 3. Routes on both sides and the SG rule: 10.0.2.15 connects to172.16.1.20:3306.

Figure 2. Animation: VPC A (10.0.0.0/16) requests a peering to VPC B (172.16.0.0/16); B accepts within 7 days; each side adds a route to the other's CIDR through pcx-..., and B's security group allows 3306 from A's app subnet.

Routes are needed on both sides VPC A route table Destination Target 10.0.0.0/16 local 172.16.0.0/16 pcx-... 0.0.0.0/0 igw-... VPC B route table Destination Target 172.16.0.0/16 local 10.0.0.0/16 pcx-... Missing on A: requests never leave A. Missing on B: requests arrive, butreplies have no way back. Add the route to the route table the subnet actually uses.

Figure 3. Route table of VPC A: 10.0.0.0/16 local, 172.16.0.0/16 to pcx-.... Route table of VPC B: 172.16.0.0/16 local, 10.0.0.0/16 to pcx-.... Both are needed.

Route tables themselves are explained in How to Create Public and Private Subnets in AWS VPC.

4. Rule 1: the CIDRs must not overlap

Why: if both VPCs contain 10.0.1.5, a route can't tell which one you mean. So AWS refuses to peer overlapping ranges.

  1. 10.0.0.0/16 and 172.16.0.0/16: no overlap. Peering works.
  2. 10.0.0.0/16 and 10.1.0.0/16: no overlap (10.0.x.x vs 10.1.x.x). Peering works.
  3. 10.0.0.0/16 and 10.0.128.0/17: the second is inside the first (10.0.128.0 to 10.0.255.255). Overlap; peering fails.
  4. Two default-style VPCs both on 10.0.0.0/16: overlap; peering fails.

So plan the CIDRs of all your VPCs on day one, different for each. How to calculate the ranges: What Is AWS VPC and How to Calculate CIDR IP Ranges.

Can these two VPCs be peered? The CIDRs mustnot overlap 10.0.0.0/16 + 172.16.0.0/16 peering works different ranges 10.0.0.0/16 + 10.1.0.0/16 peering works 10.0.x.x vs 10.1.x.x 10.0.0.0/16 + 10.0.128.0/17 overlap: fails 10.0.128.0-10.0.255.255 is inside the first 10.0.0.0/16 + 10.0.0.0/16 overlap: fails same range

Figure 4. 10.0.0.0/16 with 172.16.0.0/16 or with 10.1.0.0/16: no overlap, peering works. 10.0.0.0/16 with 10.0.128.0/17 or with another 10.0.0.0/16: overlap, peering fails.

5. Rule 2: peering is not transitive

  1. Suppose A is peered with B, and B is peered with C.
  2. A still can't reach C through B. B doesn't pass traffic on.
  3. If A needs C, create a separate A-C peering, with its own routes and SG rules.
  4. With many VPCs this becomes many links (3 VPCs need 3 peerings, 4 need 6). At that size, teams use AWS Transit Gateway as a central hub instead.
Peering is not transitive VPC A 10.0.0.0/16 A-B VPC B 10.1.0.0/16 B-C VPC C 10.2.0.0/16 ✗ A → B → C is dropped: B does not pass traffic on. A-C Fix: a separate A-C peering, with its own routes and SG rules.

Figure 5. Animation: A is peered with B and B with C, but traffic from A to C through B is dropped; a separate A-C peering is needed.

6. Accept only the requests you expect

Why: anyone with an AWS account who knows your VPC ID can send you a peering request. Accepting it, and then adding routes, connects their network to yours.

Classroom line

Suppose two roommates work for different companies.

They share a flat, but neither would connect his office laptop to the other company's network. VPCs are the same.

Suppose a software company is building a government ID system and needs private access to the government's database VPC for that project. Before accepting:

  1. Check the requester account ID: is it the partner you agreed with?
  2. Check the requester VPC CIDR: is it the range they told you?
  3. Confirm by a separate channel (email or call) that they sent it.
  4. After accepting, add routes only for the subnets that need it, and open SG rules only for the ports that need it, from the narrowest source.
  5. Anything unexpected: Reject.
Before you accept a peering request 1. Requester account ID = the partner you agreed with? 2. Requester VPC CIDR = the range they told you? 3. Confirmed by a separate channel (email or call)? 4. Accept, then add routes only for the needed subnets 5. Open only the needed ports, from the narrowest source Anything unexpected? Reject a wrong accept + routes opens your network

Figure 6. Before accepting a peering request: check the requester account ID, check the requester CIDR, confirm by a separate channel, then open only the routes and ports needed. Anything unexpected: Reject.

7. Quotas and running out of IPs

  1. VPCs per region: 5 by default. You can ask for more in Service Quotas.
  2. Running out of IPs in a VPC? Don't create a second VPC and peer it just for space. First add a secondary CIDR to the same VPC (VPC > Actions > Edit CIDRs), then create new subnets in it.

8. Build it in the console

Part A: two VPCs to practise with (one account, ap-south-1)

  1. VPC > Create VPC > VPC only: vpc-a, CIDR 10.0.0.0/16. Create a subnet 10.0.1.0/24.
  2. Create vpc-b, CIDR 172.16.0.0/16, with a subnet 172.16.1.0/24.
  3. Launch one small instance in each subnet. Give the one in vpc-a a way in for SSH (public subnet with an internet gateway, or Session Manager).
  4. On the vpc-b instance, install a web server: sudo yum install nginx -y, then sudo service nginx start.

Part B: create the peering (requester)

  1. VPC > Peering connections > Create peering connection.
  2. Name a-to-b. VPC ID (Requester): vpc-a.
  3. Select another VPC to peer with: My account (or Another account with its account ID), This Region (or Another Region), VPC ID (Accepter): vpc-b.
  4. Create peering connection. Status: Pending acceptance.

Part C: accept it (accepter)

  1. In the accepter account and region, open Peering connections and select the request.
  2. Check the requester account ID and CIDR (section 6).
  3. Actions > Accept request > Accept request. Status: Active.

Part D: routes on both sides

  1. Route tables, open the one used by vpc-a's subnet, Routes > Edit routes > Add route.
  2. Destination 172.16.0.0/16, target Peering Connection a-to-b. Save changes.
  3. Open the route table of vpc-b's subnet and add destination 10.0.0.0/16, target a-to-b. Save changes.

Part E: security group rules

  1. Open the SG of the vpc-b instance, Edit inbound rules.
  2. Add HTTP 80, source 10.0.1.0/24 (only vpc-a's subnet).
  3. For a ping test, add All ICMP - IPv4 from the same source.
  4. In the same region you can use the peer VPC's security group ID as the source instead of a CIDR.

Part F: test

  1. SSH to the vpc-a instance.
  2. Run ping -c 3 172.16.1.20 (use your vpc-b instance's private IP).
  3. Run curl http://172.16.1.20. The Nginx welcome page comes back over the private link.

9. When something goes wrong

  1. Create fails with overlapping CIDRs: the two ranges overlap. Peering needs different ranges; plan them again.
  2. Status stays Pending acceptance, then Expired: nobody accepted within 7 days. Create a new request.
  3. Active, but ping and curl time out: a route is missing on one side, or it was added to a route table the subnet doesn't use.
  4. Routes fine, still time out: the target SG doesn't allow the port (or ICMP) from the other VPC's range, or a NACL blocks it.
  5. A can reach B and B can reach C, but A can't reach C: peering isn't transitive. Peer A with C directly.

Ravindra Bagale's Tip

Give every VPC its own CIDR from day one, written down in one place, so any two can be peered later. Treat a peering request like a request to plug a stranger's cable into your office network: check the account ID and the CIDR, confirm with the person, and open only the routes and ports that are needed.

10. The whole class on one page

  1. Two VPCs can't talk by default. Opening a database to the internet is the wrong fix; peering is the private one.
  2. Peering: a private link between two VPCs, same or different accounts and regions, private IP to private IP.
  3. Requester creates, accepter accepts (within 7 days).
  4. Routes on both sides to the other CIDR through pcx-..., plus SG rules for the needed ports.
  5. CIDRs must not overlap. Peering is not transitive.
  6. Accept only requests you expect: check the account ID and CIDR.
  7. 5 VPCs per region by default (raisable). Out of IPs: add a secondary CIDR first.

11. Try at home

Try at home

Task 1: on paper

  1. Which pairs can be peered? 10.0.0.0/16 and 10.0.64.0/18; 10.0.0.0/16 and 192.168.0.0/16; 172.16.0.0/16 and 172.17.0.0/16.
  2. Four VPCs must all reach each other with peering. How many peering connections are needed?

Task 2: in the console

  1. Build vpc-a and vpc-b as in section 8, peer them, add both routes and the SG rule.
  2. From vpc-a, curl the private IP in vpc-b. Then delete one of the two routes and try again: it should time out.

Task 3: clean up

  1. Terminate both instances, delete the peering connection, then the two VPCs.

Recap

In short

  1. VPC peering privately connects two VPCs, without the internet.
  2. Request, accept, routes on both sides, security groups: all four are needed.
  3. No overlapping CIDRs, and no transit through a third VPC.
  4. Accept only what you expect, and open only what you need.

Practice Tasks

About this scenario

Ahmednagar Sugar Co-op is a sugar co-operative business in Ahilyanagar. Balasaheb Pawar looks after its IT and cloud work. They count money in INR and run their AWS resources in the ap-south-1 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.

0 / 12

Easy How many addresses in a /16?

Why: Picking a VPC size needs this count.

What to do: Ahmednagar Sugar Co-op plans the VPC 10.26.0.0/16. How many IP addresses does it hold in total?

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Easy Create a VPC

Why: A VPC is your own private network in AWS. Everything else lives inside it.

What to do: Create a VPC with the CIDR block 10.5.0.0/16.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Easy Create an internet gateway

Why: Without an internet gateway, nothing in the VPC can reach the internet.

What to do: Create a new internet gateway.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Create a subnet in one AZ

Why: Subnets split the VPC range and each one lives in exactly one AZ.

What to do: In vpc-0e5ec252f5deadbee, create subnet 10.5.1.0/24 in ap-south-1a.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Find the VPC router address

Why: AWS reserves base+1 for the router.

What to do: Which address does AWS reserve for the VPC router in subnet 10.26.4.0/24?

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Medium Usable IPs in an AWS /24 subnet

Why: AWS keeps 5 addresses in every subnet.

What to do: How many addresses can Ahmednagar Sugar Co-op use for servers in subnet 10.26.1.0/24 on AWS?

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Medium Add the internet route

Why: A subnet is "public" only when its route table sends 0.0.0.0/0 to an internet gateway.

What to do: In route table rtb-031d5da252c5bb22, send all internet traffic (0.0.0.0/0) to igw-01d5da252c5aa11.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Do these VPCs overlap?

Why: Peering fails when ranges overlap.

What to do: Can VPC 10.26.0.0/16 peer with VPC 10.26.128.0/17? Answer yes or no.

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Medium Link a subnet to a route table

Why: Until you associate it, a subnet uses the main route table.

What to do: Associate subnet subnet-031d5da252c5bb1 with route table rtb-031d5da252c5bb22.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Attach the internet gateway

Why: A gateway does nothing until it is attached to a VPC.

What to do: Attach igw-01d5da252c5aa11 to vpc-0e5ec252f5deadbee.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Hard Pick the smallest prefix

Why: Right-sizing saves address space.

What to do: A subnet must hold 100 servers on AWS. What is the largest prefix number (smallest subnet) that fits? Answer like /25.

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Hard Split a /24 into two

Why: Public and private subnets often split one block.

What to do: Split 10.26.8.0/24 into two equal subnets. Write both CIDRs separated by a comma.

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

See all practice tasks in the Task Hub →

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

Revision card: What is VPC peering?. Two VPCs cannot talk by default, even in the same account. A peering connection links two VPCs privately over AWS's network. Request, accept (within 7 days), add routes on both sides, allow in SGs. Route in VPC A:
Revision card: What is VPC peering? · Download PNG
Revision card: Peering rule: no overlapping CIDRs. If both VPCs use 10.0.0.0/16, a packet to 10.0.1.5 has two possible homes. Peering is refused when the CIDRs overlap. Plan unique CIDRs per VPC from day one. OK pair:
Revision card: Peering rule: no overlapping CIDRs · Download PNG
Revision card: Peering is not transitive. People assume A–B and B–C means A can reach C. Each pair needs its own peering. Traffic never passes through a middle VPC. Create A–C too, or use a Transit Gateway for many VPCs. 3 VPCs fully connected = 3 peerings.
Revision card: Peering is not transitive · Download PNG
Comparison: VPC peering vs Transit Gateway. VPC peering: A direct private link between two VPCs. Transit Gateway: A central hub that many VPCs attach to.
Comparison: VPC peering vs Transit Gateway · Download PNG
Interview card: A is peered with B, B with C. Can A reach C?. No. VPC peering is not transitive. Traffic cannot pass through B. Add A–C peering or use Transit Gateway.
Interview card: A is peered with B, B with C. Can A reach C? · Download PNG
Interview card: Peering is active but ping fails. What do you check?. Routes on BOTH sides and SG rules allowing the other CIDR. Peering only connects; routes and SGs decide traffic. A: 10.1.0.0/16 › pcx; B: 10.0.0.0/16 › pcx; SG allow ICMP.
Interview card: Peering is active but ping fails. What do you check? · Download PNG
Interview card: Why accept only peering requests you expect?. Accepting connects a stranger's network to yours. With routes added, they could reach your servers. Check requester account ID and CIDR first.
Interview card: Why accept only peering requests you expect? · Download PNG

More cards: Ravi Sir's Cards.