How to secure and access AWS VPC from anywhere? The Next CEO of Stack OverflowSecuring EC2 machines with VPC + a VPN?AWS VPC Multiple IPsHow do I set a VPC in AWS to 'default VPC' = true?AWS VPC internet gateway and AWS servicesAWS: VPC and NodeJSHow to access an AWS RDS host in a VPCCannot access ports behind VPC on AWSExpose a SQL server database with a load balancerRoute traffic from AWS VPC through OpenVPNHow to access this RDS server in an AWS VPC
0 rank tensor vs 1D vector
Can MTA send mail via a relay without being told so?
How many extra stops do monopods offer for tele photographs?
Find non-case sensitive string in a mixed list of elements?
Is French Guiana a (hard) EU border?
How did people program for Consoles with multiple CPUs?
When you upcast Blindness/Deafness, do all targets suffer the same effect?
Newlines in BSD sed vs gsed
Does soap repel water?
Easy to read palindrome checker
Is there always a complete, orthogonal set of unitary matrices?
The exact meaning of 'Mom made me a sandwich'
Prepend last line of stdin to entire stdin
Does increasing your ability score affect your main stat?
Why the difference in type-inference over the as-pattern in two similar function definitions?
How to place nodes around a circle from some initial angle?
Which one is the true statement?
Flying from Cape Town to England and return to another province
Why does standard notation not preserve intervals (visually)
Can a Bladesinger Wizard use Bladesong with a Hand Crossbow?
Chain wire methods together in Lightning Web Components
Is micro rebar a better way to reinforce concrete than rebar?
Method for adding error messages to a dictionary given a key
RigExpert AA-35 - Interpreting The Information
How to secure and access AWS VPC from anywhere?
The Next CEO of Stack OverflowSecuring EC2 machines with VPC + a VPN?AWS VPC Multiple IPsHow do I set a VPC in AWS to 'default VPC' = true?AWS VPC internet gateway and AWS servicesAWS: VPC and NodeJSHow to access an AWS RDS host in a VPCCannot access ports behind VPC on AWSExpose a SQL server database with a load balancerRoute traffic from AWS VPC through OpenVPNHow to access this RDS server in an AWS VPC
My scenario:
- I want to expose Wordpress REST API only to the public (for a headless CMS), and close down everything else (security risk)
- I want to be able to access a Wordpress installation from anywhere (home, office, laptop when traveling)
- I don't want anyone else to access this Wordpress installation at all. The only public endpoint should be
/wp-json/
My solution:
- Create a VPC and host Wordpress on EC2 or some other AWS service
- Expose the
/wp-json/REST API using API gateway - Deny access to the rest of the Wordpress installation for everyone but my own IP
Problem:
- My IP is not the same at home, office or when traveling.
- My IP is dynamic.
- How can I make sure I can access the /wp-admin/ from anywhere in the world with the right credentials
Possible solutions:
- VPN
- SSH tunnel
- ???
How can I solve this?
amazon-web-services
asked Mar 21 at 17:13
JohnJohn
1011
add a comment |
My scenario:
- I want to expose Wordpress REST API only to the public (for a headless CMS), and close down everything else (security risk)
- I want to be able to access a Wordpress installation from anywhere (home, office, laptop when traveling)
- I don't want anyone else to access this Wordpress installation at all. The only public endpoint should be
/wp-json/
My solution:
- Create a VPC and host Wordpress on EC2 or some other AWS service
- Expose the
/wp-json/REST API using API gateway - Deny access to the rest of the Wordpress installation for everyone but my own IP
Problem:
- My IP is not the same at home, office or when traveling.
- My IP is dynamic.
- How can I make sure I can access the /wp-admin/ from anywhere in the world with the right credentials
Possible solutions:
- VPN
- SSH tunnel
- ???
How can I solve this?
amazon-web-services
asked Mar 21 at 17:13
JohnJohn
1011
add a comment |
My scenario:
- I want to expose Wordpress REST API only to the public (for a headless CMS), and close down everything else (security risk)
- I want to be able to access a Wordpress installation from anywhere (home, office, laptop when traveling)
- I don't want anyone else to access this Wordpress installation at all. The only public endpoint should be
/wp-json/
My solution:
- Create a VPC and host Wordpress on EC2 or some other AWS service
- Expose the
/wp-json/REST API using API gateway - Deny access to the rest of the Wordpress installation for everyone but my own IP
Problem:
- My IP is not the same at home, office or when traveling.
- My IP is dynamic.
- How can I make sure I can access the /wp-admin/ from anywhere in the world with the right credentials
Possible solutions:
- VPN
- SSH tunnel
- ???
How can I solve this?
amazon-web-services
asked Mar 21 at 17:13
JohnJohn
1011
My scenario:
- I want to expose Wordpress REST API only to the public (for a headless CMS), and close down everything else (security risk)
- I want to be able to access a Wordpress installation from anywhere (home, office, laptop when traveling)
- I don't want anyone else to access this Wordpress installation at all. The only public endpoint should be
/wp-json/
My solution:
- Create a VPC and host Wordpress on EC2 or some other AWS service
- Expose the
/wp-json/REST API using API gateway - Deny access to the rest of the Wordpress installation for everyone but my own IP
Problem:
- My IP is not the same at home, office or when traveling.
- My IP is dynamic.
- How can I make sure I can access the /wp-admin/ from anywhere in the world with the right credentials
Possible solutions:
- VPN
- SSH tunnel
- ???
How can I solve this?
amazon-web-services
amazon-web-services
asked Mar 21 at 17:13
JohnJohn
1011
asked Mar 21 at 17:13
JohnJohn
1011
asked Mar 21 at 17:13
JohnJohn
1011
asked Mar 21 at 17:13
JohnJohn
1011
asked Mar 21 at 17:13
JohnJohn
1011
1011
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
I would say go with VPN. We use https://pritunl.com/ for the same purpose. To restrict access what we have done is:
- Install pritunl on a small EC2 instance (even a t2.small works).
- Attach an elastic IP to it.
- For all the resources restrict access to the elastic IP only.
- Now since you will be launching these resources in a VPC add routes in the server corresponding to that VPC (The CIDR of the VPC).
This ensures that the IP of your VPN server never changes and you can access your resources from wherever you want.
P.S. If you're launching the VPN server in the same VPC as the resource you won't have to do a VPC peering but in case you're going with a different VPC peer the two VPCs.
Pro Tip: Don't use the AWS default VPC, rather launch a new VPC and launch your resources in that. That way if you ever want to have your resources peered to a default VPC in a different region you can do it easily. Will come in handy in case you ever want to migrate your resources from one AWS region to another.
Hope this helps.
answered yesterday
Piyush BaderiaPiyush Baderia
265
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f959374%2fhow-to-secure-and-access-aws-vpc-from-anywhere%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I would say go with VPN. We use https://pritunl.com/ for the same purpose. To restrict access what we have done is:
- Install pritunl on a small EC2 instance (even a t2.small works).
- Attach an elastic IP to it.
- For all the resources restrict access to the elastic IP only.
- Now since you will be launching these resources in a VPC add routes in the server corresponding to that VPC (The CIDR of the VPC).
This ensures that the IP of your VPN server never changes and you can access your resources from wherever you want.
P.S. If you're launching the VPN server in the same VPC as the resource you won't have to do a VPC peering but in case you're going with a different VPC peer the two VPCs.
Pro Tip: Don't use the AWS default VPC, rather launch a new VPC and launch your resources in that. That way if you ever want to have your resources peered to a default VPC in a different region you can do it easily. Will come in handy in case you ever want to migrate your resources from one AWS region to another.
Hope this helps.
answered yesterday
Piyush BaderiaPiyush Baderia
265
add a comment |
I would say go with VPN. We use https://pritunl.com/ for the same purpose. To restrict access what we have done is:
- Install pritunl on a small EC2 instance (even a t2.small works).
- Attach an elastic IP to it.
- For all the resources restrict access to the elastic IP only.
- Now since you will be launching these resources in a VPC add routes in the server corresponding to that VPC (The CIDR of the VPC).
This ensures that the IP of your VPN server never changes and you can access your resources from wherever you want.
P.S. If you're launching the VPN server in the same VPC as the resource you won't have to do a VPC peering but in case you're going with a different VPC peer the two VPCs.
Pro Tip: Don't use the AWS default VPC, rather launch a new VPC and launch your resources in that. That way if you ever want to have your resources peered to a default VPC in a different region you can do it easily. Will come in handy in case you ever want to migrate your resources from one AWS region to another.
Hope this helps.
answered yesterday
Piyush BaderiaPiyush Baderia
265
add a comment |
I would say go with VPN. We use https://pritunl.com/ for the same purpose. To restrict access what we have done is:
- Install pritunl on a small EC2 instance (even a t2.small works).
- Attach an elastic IP to it.
- For all the resources restrict access to the elastic IP only.
- Now since you will be launching these resources in a VPC add routes in the server corresponding to that VPC (The CIDR of the VPC).
This ensures that the IP of your VPN server never changes and you can access your resources from wherever you want.
P.S. If you're launching the VPN server in the same VPC as the resource you won't have to do a VPC peering but in case you're going with a different VPC peer the two VPCs.
Pro Tip: Don't use the AWS default VPC, rather launch a new VPC and launch your resources in that. That way if you ever want to have your resources peered to a default VPC in a different region you can do it easily. Will come in handy in case you ever want to migrate your resources from one AWS region to another.
Hope this helps.
answered yesterday
Piyush BaderiaPiyush Baderia
265
I would say go with VPN. We use https://pritunl.com/ for the same purpose. To restrict access what we have done is:
- Install pritunl on a small EC2 instance (even a t2.small works).
- Attach an elastic IP to it.
- For all the resources restrict access to the elastic IP only.
- Now since you will be launching these resources in a VPC add routes in the server corresponding to that VPC (The CIDR of the VPC).
This ensures that the IP of your VPN server never changes and you can access your resources from wherever you want.
P.S. If you're launching the VPN server in the same VPC as the resource you won't have to do a VPC peering but in case you're going with a different VPC peer the two VPCs.
Pro Tip: Don't use the AWS default VPC, rather launch a new VPC and launch your resources in that. That way if you ever want to have your resources peered to a default VPC in a different region you can do it easily. Will come in handy in case you ever want to migrate your resources from one AWS region to another.
Hope this helps.
answered yesterday
Piyush BaderiaPiyush Baderia
265
edited yesterday
answered yesterday
Piyush BaderiaPiyush Baderia
265
answered yesterday
Piyush BaderiaPiyush Baderia
265
answered yesterday
Piyush BaderiaPiyush Baderia
265
265
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f959374%2fhow-to-secure-and-access-aws-vpc-from-anywhere%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
