Conditions are below.

  • Use static IP for all outbound traffic.
  • Send traffic through VPN Connection if it has the specific destination IPs.
  • Send traffic through the Internet if it has NOT the specific destination IPs.

And current setup.

To use static IP for outbound traffic, I setup EC2 instance as a NAT with below configuration,

iptables -t nat -A POSTROUTING -o eth0 -s -j MASQUERADE

and configured Route Table to send all subnet traffic( to that EC2 instance's network interface.

But I have to use VPN if it has specific destination IP. How do I configure the network on AWS?

  • Do you really need a NAT instance? Can you just use an Elastic IP address? That won't scale past one instance, so a NAT instance is a better solution for scale. You can start with an elastic IP attached to one server and move it to a NAT server later.
    – Tim
    Sep 28, 2018 at 18:40
  • Regarding the VPN, assume you have a VPG in your VPC? Just add a route table entry for the IPs that need to go down the VPN to the route table associated with your subnet(s).
    – Tim
    Sep 28, 2018 at 18:41

1 Answer 1


You just have to add a route:

route add -net gw metric 1

In this example is the VPN network and is your VPN gateway.

More info about routing on AWS can be found here https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .