Right now, my company is pre-launch and is getting away with a few dirty hacks. The biggest one is that our staging, ci, and monitoring boxes are available at staging.ourcompany.com, ci.ourcompany.com, and monitoring.ourcompany.com. Since they all have nice HTTP interfaces, hitting those URLs in the browser will show a nice web site-- to everyone who wanders by, whether they're in our company or not.

In a perfect world, those machines would be inaccessible unless the user is one of us. I can't predict people working from home/etc., so I don't want to just whitelist IP addresses.

My understanding is that this is where VPC comes in handy. Our machines are all hosted on EC2, so I started looking into VPC and it made my head explode.

In this scenario, what exactly do I need? My basic, almost-certainly-flawed, understanding is that we'll be VPN'ing into a box that has some sort of custom routing table, and our public DNS (eg staging.company.com) will point to an internal IP that doesn't resolve for anyone else. Then the traffic is tunneled through that VPN box?

Obviously this is a really important thing to do, but I'm clearly over my head. I have a very solid CS education and have run Linux boxes for years, but VPNs and advanced networking is really new to me. Any help would be really appreciated.

  • Why not just lock down your staging, ci, and monitoring boxes' HTTP ports via security groups in vanilla EC2 to your corporate IP?
    – ceejayoz
    Jan 24, 2012 at 21:05
  • if someone is working from home, traveling, etc. then this doesn't work
    – user358829
    Jan 24, 2012 at 21:10
  • 2
    I think the reason people may not be answering your question is that your requirements are not completely clear. for instance, are you OK with requiring employees to use a VPN client? Using an SSL VPN with OpenVPN might provide the restricted access you seek. Assign an Elastic IP to the OpenVPN server. I've set up OpenVPN in the AWS environment for several of my clients. There are many tutorials available. The tutorials may clear up some of the networking concepts that you find difficult to grasp. Jan 26, 2012 at 23:45

1 Answer 1


VPC is really for extending your corporate network, also it preforms differently than the public cloud and not all features are the same as the public cloud.

You should look into adding some sort of alternate authentication or ip checks to your non production urls. If your using ELB, security groups won't help you either(no acl ability on the ELB itself), you'll need to build a software ACL using the X-Forwarded-For header or authenticate users in some other way.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .