We have an AWS account setup with two VPCs. One has a VPN to our main campus (higher ed). We wanted to move our web servers into this VPC so that they could access on campus databases for a few items. The web servers are behind an amazon load balancer (application layer not classic).
The problem we're having is that Internet users can view the website but when the tunnel is active, on campus users cannot access the website. Traffic is flowing to the public IP of the load balancer, then into the web servers and then heading back directly through the VPN tunnel and getting dropped.
Our on campus DNS uses a product called bluecat which can't do very much so ACLs are out of the question on that based on IP. I attempted to look at route53 but aside from their private feature that only works inside the VPC, I don't see any way to choose DNS answers based on IP. Geolocation only works by locations, not IPs.
My only two remaining ideas are to spin u a BIND server inside the public VPC, create a cname on it with a new domain that either gives out the aws load balancer or the private IP of the server behind the load balancer, or to migrate all the private database connections to web app servers inside the VPN VPC and then have public web servers talk to that.
Before I try to go down either of these paths, I wanted to ask if anyone had either a routing solution or a route53 solution to this problem? Are there any pitfalls to the BIND/ACL idea?