I have a question about achieving high availability over an AWS VPN.
I have a requirement to establish a site to site VPN connection between my AWS VPC and a big corporate. This VPN link is required to support inbound http connections to an application in my AWS VPC. For various reasons, the big corporate I am connecting to will not allocate me a non-conflicting private (RFC1918) subnet to use. Instead, they require me to use NAT to expose my services over the VPN on a public IP of my choice (one that I will reserve). I believe that I have managed to successfully set this up (subject to testing) with the right combination of routing rules by following this guide (without a separate proxy), however I can only direct incoming connections to a single IP.
I am wondering if there is a way that I can direct connections to a highly available load balancer instead? This would allow better scalability and also high availability. Things I have considered:
- Using an AWS external ELB:
- These do not have reliable IP addresses or a narrow enough range. I would not be able to add such a range on the right-side routing rules as such a range could conflict with any other service hosted on AWS.
- Using an AWS internal ELB:
- These have a public DNS record and a predictable range, however these are in the private IP ranges and so cannot be used by the client system as they are only allowed to create static routes to non RFC1918 public IPs.
- Implementing my own load balancer such as HAproxy:
- This would address the scalability issue, but would still leave a single point of failure in the system (the HA node itself).
- Additionally this is one more machine I have to maintain.
Does anyone know if there is a way to reference an ELB in the VPC routing tables? Or have any other suggestions on how to achieve this?