Question

Communicating between two VPC in the same region

Posted May 23, 2020 2.1k views
Ubuntu 18.04

Hi, I am trying out DigitalOcean and I wanted to establish communication between two droplets placed in two separate VPC. These VPCs are in the same region.
I wanted to setup application server droplets in the 1st VPC and Database droplets in the second.
I wanted to isolate the VPC in which DBs are placed from access using public IP. Only app servers in the 1st VPC should be allowed to communicate with the database using the private IP addresses.

I tried pinging droplet in DB server VCP from my App server VPC but ping request does not give any output.

Any help will be appreciated.

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
Submit an Answer
4 answers

I have the same issue if you find a resolution …

Hi @skcoco,

I don’t believe this is actually possible. The whole idea of VPC is to be private. VPCs are completely isolated from both other customers and other VPCs on your own account.

Here you can further read on the product itself

https://www.digitalocean.com/docs/networking/vpc/

VPC networks are private networks that contain collections of resources that are isolated from the public internet and other VPC networks within your account, project or between teams in the same datacenter region. This means your resources, such as Droplets and databases, can reside in a network that is only accessible to other resources in the same network.

Regards,
KDSys

  • The whole idea of VPC is to be private.

    The point here is that if I have multiple VPCs, I might want to connect them. All major cloud providers support it via network peering. Either I can peer my own VPCs, or peer with someone else, to establish a private connection between their VPC and mine. IMO it’s too common to be ignored.

I have the same issue..
One method you could do it is with some clever routing.

For example,
spin up two VM’s.. One in each VPC.

Setup a VPN between both VM’s across the internet on their pub addresses.

Then route to each others backend network via that VPN. Essentially creating a gateway on both networks via an ipsec vpn across the internet.

Not exactly graceful, but it would work.

It’s simple really, you’ve got to put a router with a public IP inside the vpc. A router can be as simple as a Linux box with the right iptables rules and the right routes.

So if you have two VPCs in any region, you create two openvpn systems within each, each with a public ip. Then you make them openvpn clients of one another and on each you make them route the vpc network through the openvpn tunnel interface.

On all your systems in vpc1 you put routes to send all vpc2 traffic to the openvpn router in vpc1. When you’re on app1 in vpc1 and you ping app2 in vpc2, the packets will follow the routes, get sent to the openvpn router, who looks at its own routes and sends those packets to the openvpn router in vpc2 and then the packets go out to the vpc2 ip for app2. It sounds complicated but its simple.