AWS VPC公共Web应用程序通过VPN连接到数据库

Question

What I am trying to do is set up a web application that is public facing but makes calls to a database that is on an internal network. I have been trying to set up an AWS VPC with a public subnet, private subnet, and hardware VPN access but I can't seem to get it to work.

Can someone help me understand what the process flow here should be? My understanding is that I need a public subnet to handle the website requests and then a private subnet to connect to the VPN but what I do not understand is how to send requests down the chain and get the response. Basically what I am asking is how can I query the database via VPN from that public website?

I've tried during rout forwarding but I can't successfully complete the process.

Does anyone have any advice on something I can read on this subject or an FAQ on setting something like this up? Is it even possible? If it matters, all of these servers will be running Windows Server

I'm out of my league here, this is not my area of expertise but I'm being asked to solve this problem. Any help would be appreciated.

Thanks

Answer 1

The terminology of VPC is a little bit counter-intuitive to those of us who are familiar with IP networks, routing and NAT, so this might help:

Obviously, VPC allows you to create multiple subnets and route traffic between them. It also allows you to route traffic to additional subnets at your own data center over a tunnel established between a hardware VPN device at your side, and a companion virtual device provided by VPC.

You provision a "Virtual Private Gateway" -- that's AWS's "equipment" that terminates the VPN on their side; then you declare your own "Customer Gateway" with its public IP address (the device on your side, such as a Cisco ASA); then you bind those two entities together by declaring a "VPN Connection" between them. Right there in "VPN Connection" is where you declare static routes from the VPC network to your corporate network's private IP address space. In your local device, you configure routes through the tunnel to the private IP address space you will use inside VPC.

Still in VPC configuration, you declare your VPC's routing tables, and under "Route Propagation," you can "select the virtual private gateways which are allowed to update this route table." This injects routes pointing to your corporate network (discovered from the VPN Connection configuration) into the VPC routing tables.

One of the biggest points of confusion in VPC is the terminology of "public subnet" and "private subnet," which means something different in VPC than it means anywhere else, because all of the subnets in VPC are on private IP address space. The public/private distinction is this:

A public subnet in VPC uses the "Internet Gateway" as its default route, while a private subnet uses a "NAT Instance" or the VPN tunnel as its default route. The Internet Gateway is a virtual object, essentially just a placeholder with no real configuration, that can be used for Internet access by an EC2 instance with a public IP address -- and only by instances with public IP addresses. A NAT Instance is an EC2 machine running a custom software image that will accept traffic from internal machines that lack their own public IP address, and masquerade that traffic as having originated from its external IP address, so that the traffic can be sent across the Internet even though it originated internally from an EC2 instance without a public IP address. The return traffic from the Internet is addressed to the NAT instance, when then rewrites the headers and sends the packet back to the instance that originated the request.

The extremely counter-intuitive thing about a NAT instance is that it must be provisioned on a "public" subnet, yet it serves as the default gateway for instances provisioned on "private" subnets. Traditionally, your default gateway is on your own subnet, but in VPC, that's not the case -- still, it works perfectly.

What should take away from what I've written so far is that you don't actually "need" a private subnet -- yet -- in your VPC, based on what you're trying to accomplish, and based on what a "private" subnet means in VPC -- although I would recommend setting one up anyway using the wizard so that you have it later if you want it. The reason you don't need a private subnet is that a private subnet is where you configure EC2 instances that do not need to be Internet-accessible, and you haven't mentioned that need in your question.

If, for example, your corporate network is 172.16.0.0/16 and the private IP network 192.168.0.0/16 does not conflict with your corporate network numbering, you could declare the VPC as 192.168.0.0/16, then declare, for example, 192.168.20.0/24 (which falls inside 192.168.0.0/16) as a public subnet. On your hardware VPN device, route 192.168.0.0/16 through the tunnel toward VPC, and then, inside VPC, route 172.16.0.0/16 through the tunnel, back to the corporate network.

What I've described is primarily " VPC Scenario 3 " with the addition of the NAT Instance you can see in VPC Scenario 2 . The reason for the NAT instance is that if you do place servers on a "private" VPC subnet, Scenario 3 provides them no ability to access the Internet on an outbound basis (for fetching software updates, for example) other than by routing back to your corporate network to access the Internet that way, which to me seems an unnecessary trip, but would depend on your security philosophy.

Another thing to keep in mind, if you are considering using Elastic Load Balancer, is that the ELB needs to be provisioned on a "public" subnet, but the instances serving the ELB can be places on a "private" subnet, since in this case, only the ELB needs to be directly accessible from the Internet, and ELBs can access instances on any subnet in the VPC if the security groups and VPC routing tables permit it.

In the setup you described in the original question, though, there is no "private" subnet needed based on the VPC definition of what a "private" subnet is. The web server goes on a "public" subnet with private IP addresses, and uses Elastic IPs from the public address space and that network is directly routable to your corporate network via the VPN.

Answer 2

I'm using stunnel in my linux boxes. It seems like windows is supported too, check out the link:

http://www.stunnel.org/downloads.html

There is a tutorial talking about windows configuration. You can adapt your solution from this document: http://home.arcor.de/lightsky/docs/stunnel_openssl_synergy.pdf