AWS outposts: Added required subnet route to local gateway and Windows Firewall note
Summary
Documents adding a route in the Outpost subnet route table targeting the local gateway (with on-premises CIDR or 0.0.0.0/0 as destination) and renumbers the CND step; adds a note to verify Windows Firewall allows inbound traffic from the on-premises network.
Security assessment
The change is operational routing guidance for reaching the local gateway, plus a note about host firewall blocking traffic; it concerns network connectivity/firewall configuration rather than fixing a weakness or documenting a security control, and the firewall note is about enabling rather than restricting traffic.
Evidence
+If your instances run Microsoft Windows, verify that Windows Firewall on the instance allows inbound traffic from your on-premises network. The default firewall profile can block this traffic even when your routing domain is configured correctly.
Diff
diff --git a/outposts/latest/network-userguide/routing-domains.md b/outposts/latest/network-userguide/routing-domains.md index 80571b2..41af39c 100644 --- a//outposts/latest/network-userguide/routing-domains.md +++ b//outposts/latest/network-userguide/routing-domains.md @@ -87 +87,7 @@ This route enables traffic to flow from your Outpost through the local gateway t - 6. **Update your Customer Networking Devices (CNDs)** +For example, to send all traffic that is not destined for your VPC to your on-premises network, add a default route (0.0.0.0/0) in the LGW route table with the VIF group as the target. You can also add more specific routes for individual on-premises prefixes. + + 6. **Add a route to your VPC subnet route table** + +In the route table associated with your Outpost subnet, add a route that uses the local gateway (for example, `lgw-1234567890abcdef0`) as the target. For the destination, use your on-premises CIDR block, or 0.0.0.0/0 if you want to send all traffic that is not destined for your VPC to your on-premises network. Without this route, traffic from instances on the Outpost does not reach the local gateway. + + 7. **Update your Customer Networking Devices (CNDs)** @@ -95,0 +102,4 @@ Update your Customer Networking Devices (CNDs) to allow the VIF VLANs to send tr +###### Note + +If your instances run Microsoft Windows, verify that Windows Firewall on the instance allows inbound traffic from your on-premises network. The default firewall profile can block this traffic even when your routing domain is configured correctly. +