Able to ping EC2 from on-premises through VPN. But, unable to ping DMS replication instance

Question

I have setup a VPN and able to ping the Private IP of EC2 instance from on-premises and vice versa. However, I am unable to the ping the Private IP of DMS Replication Instance.

I have created an endpoint pointing DB in EC2. Endpoint test connection succeeds. However, endpoint test connection fails for DB in on-premises.

The EC2 and DMS Replication Instance use the same Subnet, Security Group etc., The details are given in the image below.

May I know

1) why the DMS instance is not communicating with on-premises (and vice-versa)

2) why EC2 works fine in VPN but not DMS instance?

EDIT:

Details of Security Group associated with the DMS instance:

• vpc - the same default vpc used by EC2
• inbound rules - all traffic, all protocol, all port range, source = 192.168.0.0/24
• outbound rules - all traffic, all protocol, all port range, source = 0.0.0.0/0

Route table:

• destination - 10.0.0.0/16, target = local
• destination - 0.0.0.0/0, target = internet gateway
• destination - 192.168.0.0/24, target = virtual private gateway used in VPN

This is the error message I get when I try to test the DMS DB endpoint connection:

Test Endpoint failed: Application-Status: 1020912, Application-Message: Failed to connect Network error has occurred, Application-Detailed-Message: RetCode: SQL_ERROR SqlState: HYT00 NativeError: 0 Message: [unixODBC][Microsoft][ODBC Driver 13 for SQL Server]Login timeout expired ODBC general error.

Answer 1

You might need to describe/provide your full network topology for a more precise answer, but my best guess, based on AWS' documentation on "Network Security for AWS Database Migration Service", is that you're missing source and target database configuration:

Database endpoints must include network ACLs and security group rules that allow incoming access from the replication instance. You can achieve this using the replication instance's security group, the private IP address, the public IP address, or the NAT gateway’s public address, depending on your configuration.

Also, is this EC2 you mentioned a NAT instance? Just in case:

If your network uses a VPN tunnel, the Amazon EC2 instance acting as the NAT gateway must use a security group that has rules that allow the replication instance to send traffic through it.