We have our production environment on EC2 classic, and we have a lease on some servers in a managed hosting environment. We would like to put a portion of our backend service in the data center, but there is no security built into the application yet, so we need to rely on private networks and VPN. I think this will be easier once we migrate to VPC as AWS already provides this kind of service, but we are not there yet.

Network Description

EC2 Classic puts all instances in Our data center also has a subnet within that range, but I suspect we can change that. There are two routers at the data center that can connect an IPSEC VPN.

Service Description

The services running in the data center need to be able to initiate connections to services in EC2 and also receive connections initiated by services in EC2.


I'm sure that if our services at the data center only needed to initiate connections to services in EC2, then it would just be a matter of setting up VPN endpoints in EC2 for the routers at the data center to connect to, use a different subnet in the data center, and finally, route all connections to over the VPN.

For the other direction, is the best option to configure an extra route on all EC2 instances that need to initiate connections to services in the data center?

2 Answers 2


You need to put your instances inside an Amazon VPC, with what Amazon calls a "hardware connection" to your datacenter. There are two scenarios for this : http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenarios.html I won't copy-paste what the document already says as it's pretty descriptive.

Scenario 3 and 4 are relevant to your use case.

For your specific questions

  • Network description: Yes, you can change the IP range in which your VPC lies
  • Service description: This is possible once you setup the VPN connection between your VPC and your datacenter
  • "is the best option to configure an extra route on all EC2 instances"? - You will be configuring a routing table in your VPC subnet for this which will route traffic meant for your datacenter through the VPN connection.
  • That is a nice end goal, but I was looking for a solution that fits what we have now. It would not be feasible to migrate everything to VPC immediately. Commented Oct 2, 2013 at 13:52

You may use 'Endian' or pfSense to create IPSec Site to Site VPNs. Both have small footprints and easy to configure with good documentation and even with video tutorials.



  • In this case, where would I run Endian or pfSense? Would this be on an EC2 instance that the routers at the data center would connect to? What configuration is necessary for the other EC2 instances to initiate connections to the servers in the data center? Commented Oct 1, 2013 at 16:17
  • if you already have IPSec VPN available in EC2 then you just need to configure it inside of your datacenter. Otherwise you can deploy it on both end. PS. You can also download a pfsense virtual appliance to quickly deploy it.
    – Zeeshan
    Commented Oct 1, 2013 at 20:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .