Skip to main content
In this lesson we explain site-to-site virtual private networks (VPNs) and how to use them with AWS. A VPN provides a secure, encrypted tunnel over the public Internet so that an on-premises network can communicate privately with resources inside an Amazon VPC. What problem does a VPN solve? Imagine a VPC with CIDR 10.0.0.0/16 and one or more private subnets containing instances without public IP addresses. If your on-premises datacenter uses 192.168.0.0/16 and needs access to those private resources, you need a secure, routable connection between the two networks. A site-to-site VPN uses IPsec to encrypt traffic between the on-premises Customer Gateway (CGW) and the AWS-side Virtual Private Gateway (VGW). On AWS you attach a VGW to your VPC to terminate the VPN. On-premises you deploy a CGW that terminates the other end of the IPsec tunnel; the CGW uses a public IP (for example 1.1.1.1), and AWS assigns a public IP to the VGW (for example 2.2.2.2). Once the tunnel is established, all traffic routed into the tunnel is encrypted across the Internet.
A labeled diagram titled "VPN Architecture in AWS" showing an AWS VPC (10.0.0.0/16) with private subnets connected through a VPN Gateway over the internet to a Customer Gateway and an on-premises network (192.168.0.0/16). It includes example public IPs (2.2.2.2 for the VPN Gateway and 1.1.1.1 for the Customer Gateway).

​
Key components

  • Virtual Private Gateway (VGW): the AWS-side VPN endpoint attached to your VPC.
  • Customer Gateway (CGW): your on-premises VPN endpoint with a public IP.
  • IPsec Tunnel: encrypts traffic between the CGW and VGW.
  • Routes: ensure traffic for the remote network is forwarded into the tunnel.

​
Routing options

Routing controls which traffic is sent over the VPN tunnel. AWS supports two primary approaches: Both approaches work. Use dynamic routing (BGP) when you want automatic prefix updates and easier scaling; use static routes for simple, predictable networks.
A network diagram showing a VPN connection between a cloud VPC (10.0.0.0/16) and an on-premises network (192.168.0.0/16) via a VPN gateway and customer gateway. It indicates private subnets and dynamic route exchange using BGP with example prefixes.

​
Pricing overview

AWS bills site-to-site VPNs in two main ways: Always estimate traffic egress and number of concurrent VPN connections when budgeting, since data transfer costs can be significant for heavy workloads.
A slide titled "VPN Pricing" showing two boxes: one notes a charge per available VPN connection hour and the other notes a charge for data transfer out from Amazon EC2 to the internet.

​
VPN gateway limits and characteristics

Important performance and configuration characteristics to plan for:
  • Maximum bandwidth per VPN tunnel: 1.25 Gbps.
  • Maximum packets per second: 140,000 pps.
  • MTU: 1466 bytes.
  • Multi-tunnel HA: AWS typically provisions two tunnels per connection (different AWS-side endpoints) for high availability.
  • ECMP: You can use Equal-Cost Multi-Path (ECMP) across multiple tunnels to increase aggregate throughput and resiliency.
Use multiple tunnels and ECMP when you need higher aggregate throughput or improved failover behavior.
A slide titled "VPN Gateway Limits" showing two cards: "1.25 Gbps — Maximum bandwidth per VPN tunnel" and "140,000 — Maximum packets per second."
AWS site-to-site VPN connections are commonly provisioned with two tunnels (each terminating at a different AWS-side endpoint) for high availability. Each tunnel has its own public IP and IKE/IPsec configuration; when using BGP, you can let the tunnels exchange routes and fail over automatically.
Remember: VPN traffic traverses the public Internet. Although the tunnel encrypts the traffic, you will still incur data egress charges for traffic leaving AWS.

​
Best practices

  • Use BGP route exchange when you have multiple prefixes or expect frequent topology changes.
  • Deploy the two-tunnel HA configuration AWS provides and enable ECMP where appropriate.
  • Monitor throughput and packet rates; consider AWS Direct Connect if you need predictable, high-bandwidth, and lower-latency connectivity.
  • Account for MTU (1466 bytes) when troubleshooting fragmentation or application issues across the tunnel.

​
Summary

  • A Virtual Private Gateway (VGW) is the AWS-side VPN endpoint you attach to a VPC to terminate a site-to-site VPN.
  • A Customer Gateway (CGW) is the on-premises endpoint (with a public IP) that terminates the other side of the VPN.
  • The IPsec tunnel encrypts traffic across the Internet; choose static routes or BGP for routing.
  • AWS charges an hourly fee per VPN connection plus data transfer out; VPN tunnels are limited to about 1.25 Gbps each and support ECMP for aggregation.

Watch Video