Here is the scenario I have two private subnets in two separate VPCs.
On ranges:


The 10.1 subnet is connected to a VPN gateway to a customer's VPN that all works fine. The customer has allowed all IPs on the address space to access the box on their network and that's all good.

What I want to do is have a box that is on the subnet talk to the customer's network and make it look to the customer like it's coming from the address range. The connection will be using sftp.

I can connect the two VPCs together using VPC peering and that works great. The issue is that boxes on the range cannot talk to the customer's network due to rules on their router.

Is it possible to set up a private NAT box that sits on our subnet and have the boxes on the subnet use the NAT box to connect so the connection will work (as it will look to the customer that the requests are coming from a box in the address space)? Or is there another solution to this problem?

2 Answers 2


I found the solution to my problem was to setup an nginx box in the 10.1 subnet with a simple config:

worker_processes auto;

error_log /var/log/nginx/error.log info;

events {
    worker_connections  1024;

stream {
    upstream external-vpn {

    server {
        listen 9022;
        proxy_connect_timeout 60s;
        proxy_timeout 30s;
        proxy_pass external-vpn;


With this in place and running in a docker container on an ecs cluster I can successfully connect to the external vpn box via the nginx box over sftp.


I don't know if there is a better AWS-specific way of doing this but it should certainly be possible to do it using tunneling. A tunnel carries the packets from the client box to the NAT box. The NAT box then performs the NAT and releases the packet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.