Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not interested in having all of my EC2 instances having a public IP on their network interface. I want to have full access over what boxes can speak directly to the Internet and which can be reached directly from the Internet. In a typical, very basic setup, you'd have a firewall on your DMZ with something like OpenVPN running on it so clients can get on your "internal" network and work with machines on your private LAN (RFC1918 IP space). My question is, it looks like Amazon VPC currently only caters to IPSec hardware VPN solutions. Is there anyway I can setup Amazon VPC and use a software VPN so my colleagues and I can login to our cluster of EC2 servers behind a VPN? I don't want to have slap on public IP addresses on any of the machines. The load balancer will eventually be on the DMZ and speak to the boxes behind the VPN/Firewall. What's the best way of doing this on Amazon VPC?

share|improve this question

VPC is exactly what you want. You can create a VPC with a public subnet and a private subnet and put the OpenVPN server on the public subnet. There are OpenVPN AMIs already setup to do this. see and

share|improve this answer

You can easily do it with openvpn. I followed the following posting and it worked great

share|improve this answer
That post has nothing to do with amazon's vpc. Its only about creating an openvpn tunnel to ec2. There is no private subnet, it just uses regular security groups. – recampbell Apr 18 '12 at 2:43
Just what I was looking for. This link talks about openVPN and has noting to do with VPC. Same Here. +1 – slayedbylucifer Jan 17 '14 at 11:59

OpenVPN runs fine on the Ubuntu EC2 instances we've set up. I'm not sure about the details of VPC, but if you can get one (or more) EC2 instance connected by VPN you should be able to do something and route through that connection.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.