Connecting an on-premises network to a VPC

Six ways to join an on-premises or branch network to a VPC. They differ in how quickly they can be stood up, whether traffic crosses the public internet, and how much of the operation you take on.

Managed VPN (Site-to-Site VPN)

An AWS-managed IPsec VPN over your existing internet connection.


What	AWS-managed IPsec VPN over your existing internet connection
When	You need a secure tunnel to a VPC quickly, or a backup path for Direct Connect
Pros	Fast to set up; supports static routes or BGP; two tunnels per connection for redundancy; AWS monitoring built in
Cons	Performance follows your internet connection, which AWS does not control

Setting one up

Choose the device that will act as the customer gateway — usually your on-premises router or firewall — and note its public IP address and BGP ASN.
Create a virtual private gateway (or a transit gateway) in AWS, a customer gateway resource, and the VPN connection between them.
Download the generated configuration file. AWS produces vendor-specific configurations for common routers, including Cisco, Juniper and Palo Alto.
Apply the configuration to the on-premises device.
Send traffic from your side to bring the tunnels up — the tunnels are idle until traffic or BGP keepalives start them.
Configure BGP if you want dynamic routing and automatic failover.

Getting routes into the route table

Rather than adding on-premises prefixes to VPC route tables by hand, enable route propagation on the route table associated with the virtual private gateway. The gateway then installs the routes it learns automatically, and withdraws them when the tunnel drops.

Each VPN connection provides two tunnels to two separate endpoints on the AWS side. Configuring both is what makes the connection redundant; configuring one is a single point of failure that looks like a working VPN until AWS performs maintenance on that endpoint.

Direct Connect

A dedicated private circuit into the AWS backbone, not crossing the public internet.


What	A dedicated connection over private lines straight into the AWS backbone
When	You need consistent throughput and latency, or move enough data that internet transfer costs dominate
Pros	Predictable performance; lower data transfer rates; port speeds up to 400 Gbps on dedicated connections; BGP routing
Cons	Needs a telecom or hosting provider relationship, and lead times measured in weeks

You order through your network provider or an AWS Direct Connect Partner, then create virtual interfaces on the connection: a private VIF to reach VPCs, a public VIF to reach AWS public service endpoints such as Amazon S3, or a transit VIF to reach a transit gateway.

See Direct Connect.

Direct Connect with VPN

An IPsec VPN running over the Direct Connect circuit.


What	IPsec VPN over the private Direct Connect lines
When	You want encryption in transit on top of a private circuit
Pros	Encrypted as well as private; satisfies compliance rules that require encryption end to end
Cons	Additional complexity, and the VPN’s own throughput ceiling

Also used where several companies share one Direct Connect circuit and each needs its own encrypted, separately routed path.

VPN CloudHub

Several sites, each with its own VPN connection to the same virtual private gateway, using AWS as the hub between them.


What	Connect sites in a hub-and-spoke arrangement through a virtual private gateway
When	Branch offices need to reach AWS and each other, as a primary or backup WAN
Pros	Reuses existing internet connections; BGP routing lets you prefer MPLS and fall back to CloudHub
Cons	Depends on internet quality; no inherent redundancy beyond the two tunnels per connection
How	Attach multiple customer gateways to one virtual private gateway, each with its own BGP ASN and non-overlapping address range

Traffic between sites is encrypted end to end and routed through AWS. It is inexpensive and easy to manage, and it makes a reasonable backup for an MPLS network. For anything larger, a transit gateway with VPN attachments gives the same topology with proper route tables.

Software VPN

Your own VPN software on an EC2 instance — OpenVPN, strongSwan, or a Marketplace appliance.


What	You provide the VPN endpoint and the software
When	You must control both ends for compliance, or need a VPN option AWS does not offer
Pros	Complete flexibility over protocol, ciphers and client behaviour
Cons	You design and operate the redundancy across the whole chain, and patch the instances

Transit VPC

A central VPC running third-party routing appliances that connects VPCs across Regions and on-premises sites.


What	A central VPC of virtual routers acting as a global transit centre
When	VPCs and locations across several Regions must reach each other
Pros	Vendor features and routing policies a managed service may not offer
Cons	You run the appliances; bandwidth follows the instance type; you design the redundancy

For most designs a transit gateway does this with less to operate. Keep a transit VPC where a specific appliance capability is genuinely required.

Choosing

Start with a managed VPN if you need connectivity this week. Order Direct Connect if throughput or latency consistency matters, and keep a VPN as the backup path — that pairing is the standard hybrid design. Add a transit gateway once more than a couple of VPCs are involved.