AWS Site-to-Site VPN: Can’t receive reply on on-premise Linux VM from AWS EC2

Question

I set up a Site-to-Site VPN in AWS to connect our on-premise environment with our AWS environment.

Currently, our biggest issue is solved with that since we can communicate from AWS to on-premise.

In AWS there are EC2s and RDSes, we use Strongswan on our local Debian VM this to test this setup.

I checked the Security Groups and Network ACLs which I attached to the EC2 and relevant subnet, where I allowed all traffic from all IPs, so 0.0.0.0. (This is just to test this setup)

I can ping to the public IP of my EC2s and I get an response. I ping from my on-premise Debian VM to one of my EC2s and I keep track by using tcpdump on both. I can see that we send the request in our ICMP-protocol and I can see in the EC2 reply, however that reply never makes its way through the tunnel to your the on-premise VM.

The tunnel is established and you see that everything is correct, also in AWS.

Can someone please help me? I use the Strongswan-setup. I hoped someone had the same problem.

I tried adding routes, I tried setting up again. Nothing worked.