Nerdy Drunk

• https://aws.amazon.com/blogs/aws/introducing-aws-gateway-load-balancer-easy-deployment-scalability-and-high-availability-for-partner-appliances/
• https://github.com/aws-samples/aws-gateway-load-balancer-code-samples/tree/main/aws-cli
• https://github.com/aws-samples/aws-gateway-load-balancer-code-samples/tree/main/aws-cloudformation/distributed_architecture

Below are the networks and route tables that were used during testing. I also used the default Security Group for each VPC but I added rule to allow all traffic from 10.0.0.0/8. In a production environment the security group should be more restrictive.

This configuration hairpins the GENEVE traffic from the GWLB to the VyOS instance back to the GWLB. This allows for testing but does not allow for inspection. This configuration should only be used as a POC and not used in production as it allows all traffic.

vyos@ip-10-0-0-7:~$ show configuration commands
set interfaces ethernet ens5 address 'dhcp'
set interfaces ethernet ens6 address 'dhcp'
set nat destination rule 100 destination address '10.0.0.7'
set nat destination rule 100 inbound-interface 'ens5'
set nat destination rule 100 protocol 'udp'
set nat destination rule 100 source address '10.0.0.49'
set nat destination rule 100 translation address '10.0.0.49'
set nat destination rule 100 translation port '6081'
set nat source rule 100 destination address '10.0.0.49'
set nat source rule 100 destination port '6081'
set nat source rule 100 outbound-interface 'ens5'
set nat source rule 100 protocol 'udp'
set nat source rule 100 source address '10.0.0.49'
set nat source rule 100 translation address 'masquerade'
set protocols static route 0.0.0.0/0 dhcp-interface 'ens6'

vyos@ip-10-0-0-7:~$ show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface        IP Address                        S/L  Description
---------        ----------                        ---  -----------
ens5             10.0.0.7/26                       u/u
ens6             10.0.1.7/26                       u/u
vyos@ip-10-0-0-7:~$