I have an instance of an application running in the cloud on Amazon EC2 instance of SuSE Linux, and I need it to connect to web services on my local intranet (generally port 80, but also some others) which are behind a firewall. I'm looking for a good strategy to accomplish this.

I'm thinking some sort of proxy on my Windows 2000 server inside the firewall, which would connect to the EC2 instance via an ssh tunnel. But I've never put together an ssh tunnel before. Is that the best option here? What are some recommended tools I can use to put it together?

This is for a development setup, so it doesn't have to be production-level robust. But it does need to work. Any thoughts?


Amazon just launched Virtual Private Cloud service which enables you to connect your existing infrastructure to a set of isolated AWS compute resources via an IPsec connection.


I'd setup a VPN between your Amazon EC2 instance and your local network. That will allow you to keep all of your communications private and secure, while also allowing the EC2 instance to access devices behind the firewall.

Personally, I find OpenVPN to be the perfect tool for things like this. It's very easy to setup and configure, runs well and Linux and Windows, and it's open source. Hard to go wrong. Also, I've used it heavily at multiple companies for production work, and had great success with it.


CohesiveFT has a free and commercial product for doing network "overlays" in EC2



If you are keen to use SSH it may be difficult to use with Windows 2000, you may need to investigate Services for UNIX or Cygwin. Personally I would not use SSH for this situation. I tend to find SSH is not the best for a long term solution and for general tunnelling it imposes noticable amounts of overhead.

I would agree that OpenVPN is the ideal tool, it imposes far less overhead and has far better windows support than SSH. I would use the Windows 2000 machine as a bridge between your network and the EC2 instance. Have your routers forward all traffic destined to your EC2 elastic IP range to the Windows 2000 box. Using OpenVPN to create a tunnel to your EC2 instance, have the Win2k box bridge traffic from the physical network to the virtual interface created by OpenVPN. This would create a transparent solution with limited delay and overhead.

OpenVPN is a mature and dependable solution that I have frequently used in similar situations, I find it is generally better documented and supported than commercial alternatives.


You could use the Service Bus in Azure .NET Services to securely relay your messages between your cloud instance and your intranet web services. We're using this to call internal web services from Windows Azure. The service is obviously much easier to use if you're using .NET web services (using built in libraries), but the service is supposed to be vendor agnostic via a REST API.

Unfortunately, documentation is a bit sparse. You wouldn't need any VPN using this model though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.