Question

Your company deployed a firewall virtual appliance in a VPC to inspect all egress traffic to the internet. You created a custom static route with destination 0.0.0.0/0 and next hop set to the appliance instance, with priority 1000. However, traffic from workload VMs is still bypassing the appliance and going directly to the internet via the default route. You need all workload VM egress to flow through the appliance while leaving other VMs unaffected. What should you do?

Accepted Answer

Create a new custom static route to 0.0.0.0/0 with next hop the appliance, set a priority value lower than 1000 (e.g., 100), and apply an instance tag that matches only the workload VMs.

Answer

Delete the default 0.0.0.0/0 internet gateway route so that the appliance route becomes the only default route in the VPC.

Answer

Increase the priority value of the existing appliance route to 2000 so it takes precedence over the default internet gateway route.

Answer

Add a network tag to the appliance instance and reference that tag in the existing route so only tagged traffic is forwarded.