VPN acts somewhat similarly to the proxy that takes in the requests of client and forwards it to the instances on the private subnet. Like bastion, VPN server needs to be on the public subnet so that users can access it.
This is the basic diagram showing how VPN fits into a typical environment:
Although it might look similar to what we had in bastion host, the purpose of VPN is wider than that of bastion hosts. Bastion hosts typically work with SSH and they do key forwarding and all that magic, but it is not meant for protocols other than SSH.
Let's take a use case. There is an application server running on port 8080 on the Private Subnet. The user wants to open the application in the browser, typically via http://Server–IP:8080/.
Since the server is on Private Subnet with a private IP, you won't be able to connect directly.
So, in this...
