OCI VCN peering connected but traffic doesn't flow: route tables, security rules and overlapping CIDRs for LPG and DRG peering

#Symptoms

• The Local Peering Gateway (LPG) shows Peering status: Peered, or both VCNs are attached to the same DRG, but ping / ssh / application traffic between them times out.
• Traffic works one way only.
• It worked until someone added a new subnet or changed a route table.

Peering only creates the path. Each side still needs routes and security rules, and the host OS must allow the traffic.

#Step 1: Confirm the peering itself

For LPGs:

oci network local-peering-gateway list --compartment-id $COMPARTMENT --vcn-id $VCN_A \
  --query 'data[].{name:"display-name", status:"peering-status", peer:"peer-advertised-cidr", rt:"route-table-id"}' \
  --output table

peering-status must be PEERED, and peer-advertised-cidr shows the CIDR the other side advertises. If it's PENDING or REVOKED, recreate the connection (oci network local-peering-gateway connect --local-peering-gateway-id ... --peer-id ...). Cross-tenancy LPG peering also needs the requestor/acceptor IAM policies in both tenancies.

For DRG attachments:

oci network drg-attachment list --compartment-id $COMPARTMENT --drg-id $DRG \
  --query 'data[].{name:"display-name", type:"network-details".type, state:"lifecycle-state", drgrt:"drg-route-table-id"}' \
  --output table

All attachments should be ATTACHED.

#Step 2: Route rules on both subnets

Each subnet's route table needs a rule for the other VCN's CIDR pointing at the LPG (or DRG):

SUBNET_RT=$(oci network subnet get --subnet-id $SUBNET_A --query 'data."route-table-id"' --raw-output)
oci network route-table get --rt-id $SUBNET_RT \
  --query 'data."route-rules"[].{dest:destination, target:"network-entity-id"}' --output table

Expected in VCN A's subnet: 10.20.0.0/16 → ocid1.localpeeringgateway... (VCN B's CIDR). And the mirror image in VCN B.

Warning

oci network route-table update --route-rules replaces all rules. Fetch the current list, add the peering rule, and send the full list back, or you'll remove your NAT/Service Gateway routes.

For DRG-based peering, also check the DRG route table attached to each VCN attachment. With the default auto-generated DRG route tables, VCN attachments import each other's routes. If someone attached a custom DRG route table or import distribution, the route to the other VCN may be missing:

oci network drg-route-rule list --drg-route-table-id $DRG_RT \
  --query 'data[].{dest:destination, nexthop:"next-hop-drg-attachment-id", type:"route-type"}' --output table

Look for VCN B's CIDR with VCN B's attachment as next hop.

#Step 3: Security lists and NSGs

Both directions need rules:

Check what applies to the target VNIC (security list on the subnet plus any NSGs on the VNIC; a packet is allowed if either allows it):

oci network vnic get --vnic-id $VNIC_B --query 'data."nsg-ids"'
oci network security-list get --security-list-id $SL_B \
  --query 'data."ingress-security-rules"[].{src:source, proto:protocol, tcp:"tcp-options"}'

ICMP is often missing, so ping fails while TCP works. Test with the real port before concluding peering is broken.

#Step 4: Host firewall

Oracle Linux images ship with firewalld on, and many hardened images allow only SSH from specific ranges:

sudo firewall-cmd --list-all
sudo firewall-cmd --permanent --add-port=5432/tcp && sudo firewall-cmd --reload

Windows images have Windows Firewall rules too. Test locally and remotely:

# On the target
sudo ss -ltnp | grep 5432
# From the source
nc -vz 10.20.1.15 5432

If the service listens only on 127.0.0.1, no network fix will help.

#Step 5: Overlapping or changed CIDRs

LPG and DRG peering can't route between overlapping address space. Symptoms: the peering is accepted, but traffic for the overlapping range stays local.

oci network vcn get --vcn-id $VCN_A --query 'data."cidr-blocks"'
oci network vcn get --vcn-id $VCN_B --query 'data."cidr-blocks"'

If someone added a secondary CIDR to one VCN that overlaps the other, remove it or move the workload. For LPGs, the peer only advertises what's allowed; check peer-advertised-cidr again after any CIDR change.

#Step 6: Transit routing surprises

LPG peering is not transitive. VCN A ↔ VCN B and VCN B ↔ VCN C doesn't give A ↔ C. Options:

• Attach all VCNs to one DRG (DRG v2 supports many VCN attachments and full mesh by default).
• Use a hub VCN with transit routing (route table on the LPG pointing at a firewall or DRG), which needs route tables on the LPG itself.

#Use VCN Flow Logs and Network Path Analyzer

Two tools save a lot of guessing:

• Network Path Analyzer (Networking > Network Command Center): give source IP, destination IP, protocol and port. It walks routes and security rules and tells you which hop drops the packet.
• VCN Flow Logs on the target subnet: REJECT entries mean a security rule dropped it; no entries at all means the packet never arrived (routing).

#Symptom → fix table

#Prevent it next time

• Manage peering, route tables and security rules for both VCNs in the same Terraform module, so one side can't drift.
• Prefer DRG attachments over LPG meshes once you have more than two or three VCNs.
• Keep an IP plan with non-overlapping ranges per region and environment.
• Enable flow logs on shared subnets and keep Network Path Analyzer in your runbook.