从 aws vpn 连接控制访问子网

Question

默认情况下，当您使用 AWS 通过客户网关和 VPG 提供的 VPN 连接时，它可以访问您的所有 vpc，我们如何控制此访问或将其限制为仅单个子网。

Answer 1

When you create a VPN connection, you have the choice between static and BGP. Further, if you choose to use BGP, you propagate the advertised routes into the VPC.

But even if you're using BGP, you can choose not to propagate the routes, and manually manage the routes in the VPC.

So you can create a route per subnet, and if you want a subnet to have access to the servers on the other side of the VPN, you can add the appropriate routes to that route table.

Answer 2

Terminate your VPN connection on a TGW which then can have individual routes to separate VPCs.