with default vpc, amazon dhcp gives the instances a private ip, which cannot be routed out from the aws internet gateway (this device looks like IGW-xxxxxxx via console). so unless the aws instances route to the internet thru the ipsec tunnel gateway (looks like VGW-xxxxxx), there are two ways to allow connectivity out to the internet.
1) give vpc instances public elastic ip's, ensure a default route to the amazon internet gateway, then add a route for your private lan to the ipsec termination gateway
2) set up a second instance with iptables masquerading, and then have default route to that device, while keeping the private lan route to the ipsec termination point (back to your offic)
with #1, if instances have public eip, then may be connected to from the internet, if you are not careful with security groups.
with #2, all traffic is limited by the masquarading instance, which is then a point of failure. (by using amazons internet gateway, im sure they use VRRP/HSRP/CARP/ETC, so its HA). also, although it has not happened to me personally, the private ip of the masq'ing box could change, and so you would need to update dhcp lease info, and then force/wait to renew instance leases.