Lecture 110: EC2 based VPN
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：07:10
- 来源：Udemy Lecture 26204186
- Slide 数量：5
- 画面切换：00:40、03:57、05:51、06:14
扫描说明
逐条检查了 Udemy 页面中的 91 条 Transcript cue，并以每条 cue 对应画面为时间轴逐段扫描全长约 7:10 的视频。依据标题、在 EC2 上终止 VPN 的使用理由、路由与运维注意事项、自建高可用架构、扩展方式五个独立画面阶段，共划分出 5 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. EC2-based VPN 的定位
时间范围：00:00–00:40
总结 / Summary
中文
AWS 托管站点到站点 VPN（AWS Managed Site-to-Site VPN）通常是首选，但它不能覆盖所有协议、路由及安全需求。EC2-based VPN 是一种客户自管方案：在 Amazon EC2 实例上安装 VPN 软件，并让该实例充当 AWS 侧的 VPN 终止端点（VPN termination endpoint）。
English
AWS Managed Site-to-Site VPN is normally the preferred option, but it cannot satisfy every protocol, routing, and security requirement. An EC2-based VPN is a customer-managed alternative in which VPN software runs on an Amazon EC2 instance that acts as the AWS-side VPN termination endpoint.
Transcript
00:00 Alright, now so far, in this section, we have talked about AWS managed site to site VPN
00:06 and this is what AWS would want you to use all the time, right.
00:11 However, different customers have different requirements and it is not possible that every
00:15 time you use only AWS site to site VPN.
00:19 And sometimes you have to use custom solution and in that case, you might use EC2 instance
00:25 for your VPN termination inside AWS.
00:29 So in this lecture, let's talk about whether it is possible to use EC2 based VPN and then
00:35 what are the considerations for using the EC2 based VPN solution.
2. 为何在 EC2 上终止 VPN
时间范围：00:40–03:57
总结 / Summary
中文
把 VPN 终止在公有子网（public subnet）中的 EC2 实例上，可获得对软件、路由和数据处理的完整控制。典型动机包括使用 IPsec 之外的协议，例如通用路由封装（Generic Routing Encapsulation, GRE）或动态多点 VPN（Dynamic Multipoint VPN, DMVPN）；借助源地址转换（Source NAT）和目的地址转换（Destination NAT）处理重叠 CIDR；实现传递路由（transitive routing）；在终止端点部署高级威胁防护（Advanced Threat Protection）；以及突破托管 VPN 单隧道约 1.25 Gbps 的带宽限制。实际吞吐量由 EC2 实例及其网络能力决定，课程说明互联网流量在合适条件下可达到更高带宽。
English
Terminating the VPN on an EC2 instance in a public subnet provides full control over the software, routing, and packet handling. Common reasons include using non-IPsec protocols such as GRE or DMVPN, resolving overlapping CIDRs with source and destination NAT, enabling transitive routing, installing advanced threat-protection features on the endpoint, and exceeding the managed VPN tunnel's roughly 1.25-Gbps bandwidth ceiling. Actual throughput depends on the EC2 instance and its networking capabilities.
Transcript
00:40 So the first question, why would you use EC2 based VPN and the architecture is something
00:46 like this, where your EC2 instance might be in a public subnet.
00:49 It has a VPN software and then you terminate your VPN connection on this EC2 instance.
00:55 So this traffic goes over the internet and then you have the application server inside
01:00 the VPC and all this communication is within the VPC.
01:05 So why would you do that?
01:06 So generally, you will do this if you want a different protocol than the IPSec protocol
01:12 and there are many protocols for the VPN, for example, GRE, that is General Routing
01:17 Encapsulation or DMVPN.
01:20 So that could be one reason that you want to specifically use this VPN protocol.
01:25 Alright, other than that, if you have the overlapping CIDR ranges on the AWS side and
01:31 the customer side, then also typically you will look to use this solution.
01:35 Here because the VPN is terminating on the EC2 instance, you have full control over the routing.
01:41 So there you can implement the source NATing and the destination NATing and further you
01:45 can manage the IPSec route tables because it's a Linux system.
01:50 So in that way, even if there are overlapping CIDR ranges at both the end, EC2 can handle
01:55 that and otherwise if you are using the AWS managed side-to-side VPN, you know that it
02:01 is not possible to have overlapping CIDR ranges.
02:04 So that's second reason.
02:06 Third reason could be because you want to have transitive routing, that means from this
02:11 VPC, you want to further reach out to another VPCs via the VPN connection.
02:17 Now in case of AWS managed side-to-side VPN, that's not possible.
02:21 But because now you are terminating the VPN on the EC2 instance and EC2 instance has its
02:26 own ENI and there are routing routes which applies to the subnet level, this kind of
02:31 transitive routing is possible.
02:33 Next, if you want a special feature, for example, advanced threat detection to be deployed on
02:39 the same instance as your VPN software, then it is not possible to do that with AWS managed
02:46 side-to-side VPN.
02:47 For that, AWS recommends to use other firewalls like AWS network firewall or gateway load
02:53 balancer but it doesn't natively come with AWS side-to-side VPN.
02:58 However, because now you are terminating the VPN on the EC2 instance, you can install any
03:04 advanced threat detection software on this instance.
03:08 And finally, as you know, AWS side-to-side VPN tunnel has maximum bandwidth of 1.25 Gbps
03:15 But here because you are using the EC2 based VPN, you are limited by the EC2 bandwidth
03:21 and typically for the internet bound traffic, you can get up to 10 Gbps bandwidth.
03:26 Now these numbers are not fixed and there are a lot of factors to consider but for sure
03:31 you can get more than 1.25 Gbps bandwidth.
03:36 So these are some of the reasons for which you will use EC2 based VPN and in your exam,
03:41 if the question talks about any of these requirements, then you should consider using
03:46 EC2 for your VPN termination.
03:50 Alright now if you decide to terminate your VPN on the EC2 instance, then there are few
03:55 things that you should know.
3. 路由、高可用与软件责任
时间范围：03:57–05:51
总结 / Summary
中文
当 EC2 实例充当 VPN 路由器时，必须禁用源/目的地址检查（Source/Destination Check），并在操作系统（operating system）中启用 IP 转发（IP forwarding）。在共享责任模型（Shared Responsibility Model）下，客户负责实例可用性、VPN 配置、补丁及软件支持；可结合 Amazon CloudWatch 状态检查（status check）启用 EC2 自动恢复（EC2 Auto Recovery）。AWS Marketplace 中的第三方 VPN 设备镜像（VPN appliance AMI）可提供内置高可用（High Availability, HA）和集中管理功能，但通常需要额外许可费用。
English
When an EC2 instance acts as a VPN router, Source/Destination Check must be disabled and IP forwarding must be enabled in the operating system. Under the Shared Responsibility Model, the customer owns instance availability, VPN configuration, patching, and software support. EC2 Auto Recovery can be driven by CloudWatch status checks. Third-party VPN appliance AMIs from AWS Marketplace may offer built-in high availability and centralized management, generally at additional licensing cost.
Transcript
03:57 First, the routing.
03:59 So because it's a EC2 instance and you will be using it as a VPN router, then you should
04:05 disable the source destination check.
04:07 And if you remember, we had talked about that while talking about the NAT EC2 instance.
04:12 Further, you should also enable the IP forwarding at the operating system level.
04:17 So that will be the routing configuration.
04:19 Second, now because it's an EC2 instance, it comes under the shared responsibility model
04:24 where all the configurations and everything should be managed by the customer and that's
04:29 where if EC2 gets any problem, then you should make sure that you enable the auto-recovery
04:36 using the CloudWatch status check.
04:38 In that sense, your VPN will be up.
04:40 However, as you know, if you are using side-to-side VPN connection, AWS provides two tunnels
04:45 for high availability and there is automatic failover to the another tunnel.
04:50 Further, here because you are managing the EC2 instance, you have to also manage the
04:55 VPN software on that EC2 instance.
04:58 So AWS won't manage it for you, unlike if you are using AWS managed side-to-side VPN.
05:05 Now, one good thing here is that AWS marketplace provides lot of these softwares out of the
05:05 box in the form of AWS EC2 AMI.
05:15 Now in that case, if you use this licensed software, the availability and the patching
05:21 and everything can be taken care by these third-party vendors.
05:25 So that's an option, but again, you have to pay extra cost for that.
05:29 Next, if you want a HA solution, which means if one EC2 instance goes down, you should
05:34 still have the VPN running on another EC2 instance.
05:38 So for that, you can build the custom architecture, something like this, where if this first VPN
05:45 goes down, you detect that using say CloudWatch status and then you trigger a lambda function
4. EC2 VPN 高可用架构
时间范围：05:51–06:14
总结 / Summary
中文
EC2-based VPN 不会自动获得 AWS 托管 VPN 的双隧道故障转移能力。自建高可用（High Availability, HA）方案可在不同可用区（Availability Zone, AZ）部署两台 VPN 实例，让本地客户路由器（customer router）分别建立隧道；当主实例故障时，由 CloudWatch 检测状态，并触发 AWS Lambda 等自动化来更新 VPC 路由表（route table），把下一跳（next hop）切换到备用实例。该故障检测与路由切换逻辑需要客户自行设计。
English
An EC2-based VPN does not automatically inherit the dual-tunnel failover of AWS Managed VPN. A custom HA design can place two VPN instances in different Availability Zones and establish a tunnel from the on-premises customer router to each one. If the primary fails, CloudWatch can detect the condition and automation such as AWS Lambda can update VPC route tables so the next hop points to the standby instance. The customer must design this health-detection and route-switching workflow.
Transcript
05:51 to automatically update the root table for this subnet where the target will be now second VPN.
05:58 So you have to build this solution yourself because this doesn't come out of the box.
06:04 Alright, now the last thing with respect to the scaling, if you are thinking to horizontally
06:09 scale the EC2 instance, that means you could have multiple VPN softwares and then you want
5. 水平扩展与垂直扩展
时间范围：06:14–07:10
总结 / Summary
中文
水平扩展（horizontal scaling）很难通过普通负载均衡器实现：IPsec VPN 使用有状态的封装安全载荷协议 50（Encapsulating Security Payload, ESP protocol 50），应用负载均衡器（Application Load Balancer, ALB）与网络负载均衡器（Network Load Balancer, NLB）不能把同一隧道的状态分散到多台 EC2 VPN 实例。更直接的做法是垂直扩展（vertical scaling），即选择更大的 EC2 实例规格，以提高处理性能和潜在网络带宽。
English
Horizontal scaling is difficult with ordinary load balancers. IPsec VPN uses stateful Encapsulating Security Payload protocol 50, and neither an Application Load Balancer nor a Network Load Balancer can distribute one tunnel's state across multiple EC2 VPN instances. The more direct option is vertical scaling: select a larger EC2 instance type to increase processing performance and potential network bandwidth.
Transcript
06:14 to distribute traffic to those.
06:16 Now that's very difficult to achieve because for horizontal scaling, you need the load
06:21 balancer and whether NLB or the ALB, they do not support the IPSec ESP-50 protocol.
06:31 And that's where you can't use NLB or the ALB for distributing the VPN traffic across
06:37 your VPN instances.
06:40 So just remember that.
06:42 So that's about the horizontal scaling.
06:44 And you can also do the vertical scaling, which means you can just increase the size
06:48 of EC2 instance, which will increase the performance as well as it may support higher bandwidth.
06:56 So you need to consider all these things when using EC2 based VPN.
07:02 So these are all the important things about the EC2 based VPN that you should know.
07:06 And with that, now let's go to the next lecture.
整讲总结 / Overall Summary
中文
EC2-based VPN 以更高的控制权换取更大的客户责任。它适用于非标准 VPN 协议、重叠 CIDR、传递路由（transitive routing）、定制安全能力或更高带宽等需求；同时必须正确配置源/目的地址检查（Source/Destination Check）与 IP 转发（IP forwarding），自行管理软件和高可用（High Availability, HA），并理解 IPsec ESP 50 对水平负载均衡的限制。
English
An EC2-based VPN trades greater control for greater customer responsibility. It is useful for nonstandard VPN protocols, overlapping CIDRs, transitive routing, custom security capabilities, or higher bandwidth. It also requires correct Source/Destination Check and IP-forwarding settings, customer-managed software and high availability, and awareness that stateful IPsec ESP 50 traffic does not fit ordinary horizontal load balancing.
返回顶部 ↑