I have a VPC ( with public ( and private ( subnets. I have ELBs in the public subnet and EC2 Webservers in the private one. I've also setup a VPN Gateway, Consumer Gateway and a VPN connection to allow a client to access our VPC.

How do I lock down the VPN connection to a subnet that is dedicated only for VPN (VPN-only subnet). I am planning to have EC2 instances in the VPN-only subnet and the client should be able to access those servers.


  • Is there a reason you cannot use the private subnet as your VPC subnet? It looks like the only reason you need the VPN subnet is to let VPN clients in? That can be accomplished by providing a Hardware VPN Gateway in the private subnet. Aug 2, 2017 at 1:53

1 Answer 1


First off, you should have multiple public and multiple private subnets.

The routes for the public subnets should have targeting the IGW, which you don't mention in your question.

The private subnets can do the same - should target the VGW.

Because the local route cannot be edited, and points to the CIDR block for the entire VPC, if you want to restrict access between public and private subnets, you will need to have Network ACLs on your subnets to deny undesired traffic. The same mechanism could be used to restrict traffic coming in from the VPN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.