Possible to remove ‘local’ route from AWS VPC

You do not need to add a route into any routing table for this to work. It can be accomplished in a few steps in the console

1. Go to "VPN Connections", select the connection for your corporate LAN, go to the "Static Routes" tab and add the new IP subnet
2. Go to "Route Tables", select the table you want to modify, go to the "Route Propagation" tab and insure the Virtual Private Gateway for your corporate LAN is checked
3. Insure that the route table modified in the previous step is associated with the subnets you want ("Subnets", select a subnet, "Route Table")

Note: You can only have one route table associated with a subnet at a time. If you have changed the route table from the main routing table to a custom one, you will need to insure that route table has route propagation enabled for your virtual private gateway.

Additional things to check:

• Be sure that routes are setup appropriately on your corporate LAN so that packets from the new IP subnet to the VPC subnet will be appropriately routed via your customer gateway
• Insure that if you were filtering packets on your customer gateway you enable packets with the new IP subnet as the source.

As always review the Amazon Virtual Private Cloud documentation.

You need a route and open network ACLs from the webserver-tier subnet back to the bastion-tier subnet or your response packets will never make it back to the server. Enable ICMP (and make sure your ping client is using ICMP only -- some use UDP packets by default) from webserver subnet to bastion and open the appropriate ephemeral TCP ports (range is generally OS-dependent; see http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html#VPC_ACLs_Ephemeral_Ports) from webserver-tier to bastion-tier.

If you run tcpdump on a webserver instance and a bastion instance simultaenously, you would likely see the webserver is getting the bastion packets and sending a response, but the bastion instance is never getting the response.