Allow also ESP/AH encapsulation on AWS
The new nat discovery protocol can detect connectivity over private IPs
and that means that nat traversal is disabled by default, triggering ESP
protocol which is expected to be more performant than UDP encap.
@@ -109,6 +109,22 @@ resource "aws_security_group" "submariner_gw_sg" {
cidr_blocks = ["0.0.0.0/0"]
}
+ # ESP encapsulation protocol
+ ingress {
+ protocol = 50
+ cidr_blocks = ["0.0.0.0/0"]
+ to_port = 0
+ from_port = 0
+ }
+
+ # AH protocol
+ ingress {
+ protocol = 51
+ cidr_blocks = ["0.0.0.0/0"]
+ to_port = 0
+ from_port = 0
+ }
+
tags = merge(map(
"Name", "${var.cluster_id}-submariner-gw-sg",
))
