traceroute to 172.16.1.16 (172.16.1.16), 30 hops max, 60 byte packets
 1  172.16.1.102 (172.16.1.102)  62.661 ms  65.560 ms  65.445 ms
 2  172.16.1.16 (172.16.1.16)  65.623 ms * *

root@ip-172-16-1-102:~# traceroute 192.168.1.10
traceroute to 192.168.1.10 (192.168.1.10), 30 hops max, 60 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 .........
 30  * * *

version 2.0

config setup
 nat_traversal=yes
 protostack=netkey
 force_keepalive=yes
 keep_alive=60
 oe=off
 nhelpers=0

conn AWS2LocalConnection
 left=172.16.1.102 #EC2 Private IP
 leftsubnets=172.16.0.0/16 #VPC CIDR
 leftid=54.201.191.5 #EC2 EIP
 leftsourceip=172.16.1.102 #EC2 Private IP
 right=71.170.22.8 #My on-prem Router public IP
 rightsubnets=192.168.1.0/24 #My on-prem Network
 rightid=71.170.22.8 #My on-prem Router public IP
 pfs=no
 forceencaps=yes
 authby=secret
 auto=start

71.170.22.8 54.201.191.5: PSK "password"

iptables -t nat -A POSTROUTING -s 172.16.0.0/16 ! -d 192.168.1.0/24 -o eth0 -j MASQUERADE

version 2.0

config setup
 nat_traversal=yes
 protostack=netkey
 force_keepalive=yes
 keep_alive=60
 oe=off
 nhelpers=0

conn Local2AWSConnection
 type=tunnel
 left=192.168.1.100 #Client Local IP
 leftsubnets=192.168.1.0/24 #On-prem Network
 leftid=71.170.22.8 #Router Public IP
 leftsourceip=192.168.1.100 #Client Local IP
 right=54.201.191.5 #EC2 EIP
 rightsubnets=172.16.0.0/16 #VPC CIDR
 rightid=54.201.191.5 #EC2 EIP
 pfs=no
 forceencaps=yes
 authby=secret
 auto=start

54.201.191.5 71.170.22.8 : PSK "password"

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 ! -d 172.16.0.0/16 -o eth0 -j MASQUERADE