I have a VPC with one public subnet and one private.
The public subnet has an OpenVpn Server and a public IP
The private subnet has a Win 2012R2 Server with an Oracle 11g server.
My set up:
1. VPC: VPC 2. Public Subnet: Summary for public subnet

Route table for public subnet

  1. Private Subnet: Summary for private subnet

    1. Internet gateway Internet gateway attach to my VPC

    2. Security Groups: 5a: For the VPN server: enter image description here 5b: For the Win Server (with the oracle server) enter image description here

So, I've set up the OpenVPN server and I am able to connect to the database from my laptop. Everything is fine. Now I want to run FileZilla in my Win Server to download some files from ftp sites.
I add more security groups to my Win Server with inbound and outbound rules but it doesn't work. I think that I have to add a route table for my private subnet to connect to outside world, but I have no idea how to implement that.

Rules that I have tried (inbound and outbound): enter image description here

Route table that I tried:
enter image description here

Any ideas?


The recommenced way to architect a VPC with Public and Private Subnet, where you want outgoing access to the internet from a private subnet, is to implement a Network Address Translation server on the public internet, and route requests from the private subnet through the NAT instance.

Your approach here, routing the designated private subnet to an Internet Gateway (IGW), causes that subnet to become a public subnet. As you may know, it is not considered best security practice to host database servers on public subnets.

I would consider implementing a NAT as is recommenced in this scenario. As an alternative you could do the FTP activity on the public side, and transfer files to the private subnet via some other means (eg directory shares, an ftp server on the public subnet, allowing the private subnet access to the ftp/public subnet)

  • Can't I use the OpenVpn Server as NAT? – Nianios Oct 19 '15 at 9:13
  • Yes, you may use any instance (in a public facing subnet in VPC) running OpenVPN as a NAT server. Make sure you have disabled disable source/destination checking on that instance. – Rodrigo M Oct 19 '15 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.