AWS • HYBRID CLOUD • NETWORKING • SECURITY

AWS Hybrid Cloud Infrastructure

Secure Site-to-Site connectivity between an on-premises enterprise lab and AWS using pfSense, redundant IPsec VPN tunnels, segmented VPC networking, EC2 workloads, IAM controls, and centralized cloud monitoring.

I designed and deployed a hybrid cloud environment that connects my VMware-based enterprise infrastructure to AWS through pfSense. The project combines cloud networking, secure routing, compute, identity, logging, monitoring, and redundancy into a working enterprise-style architecture.

View GitHub Repository Back to Projects

Project Snapshot

Hybrid Connectivity

Connected the on-premises VMware environment to AWS through pfSense using AWS Site-to-Site IPsec VPN.

Redundant VPN Tunnels

Configured both AWS-provided VPN tunnels and validated tunnel establishment from AWS and pfSense.

AWS Networking

Built a dedicated VPC with public and private subnets, route tables, an Internet Gateway, and controlled hybrid routing.

Compute

Deployed EC2 workloads for public web services and private application infrastructure.

Security

Applied security groups, IAM roles, root-account MFA, IMDSv2, and network-level access restrictions.

Monitoring & Audit

Used CloudTrail, CloudWatch, alarms, and S3 to support visibility, auditing, and operational monitoring.

HYBRID ARCHITECTURE

Environment Architecture

The project extends the on-premises enterprise environment into AWS while keeping both environments logically segmented.

pfSense acts as the hybrid-cloud edge device and provides encrypted Site-to-Site connectivity between the local corporate networks and the AWS VPC.

                         ON-PREMISES
                     VMware Workstation
                             |
                             |
                     +----------------+
                     |    pfSense     |
                     | Firewall / VPN |
                     +----------------+
                             |
                  Site-to-Site IPsec VPN
                    Tunnel 1 + Tunnel 2
                             |
                             v
                   AWS VIRTUAL PRIVATE
                        GATEWAY
                             |
                             v
                     +------------------+
                     |     CORP-VPC     |
                     |   10.10.0.0/16   |
                     +------------------+
                             |
             +---------------+---------------+
             |                               |
             v                               v

     CORP-PUBLIC-SUBNET              CORP-PRIVATE-SUBNET
        Public Workloads                Private Workloads
             |                               |
             v                               v

         CORP-WEB01                     CORP-APP01
        10.10.10.133                    Private EC2

             |                               |
             +---------------+---------------+
                             |
                             v

                 AWS SECURITY & OPERATIONS
                 -------------------------
                 IAM
                 Security Groups
                 CloudTrail
                 CloudWatch
                 S3

AWS NETWORKING

VPC Design & Segmentation

I created a dedicated AWS VPC using the 10.10.0.0/16 address space and separated cloud workloads into public and private subnets.

The public subnet supports internet-facing resources while the private subnet provides a separate security zone for internal application infrastructure.

AWS VPC 10.10.0.0/16 Public Subnet Private Subnet Route Tables Internet Gateway Hybrid Routing

AWS CORP VPC resource map showing public and private subnets and route tables — CORP-VPC resource map showing the public and private subnet structure, route tables, and Internet Gateway.

EC2 Infrastructure

The cloud environment contains multiple EC2 workloads with different infrastructure roles.

The public-facing system provides the web-service layer while the private system demonstrates separation of application workloads from directly exposed infrastructure.

AWS EC2 instances CORP-WEB01 and CORP-APP01 — AWS EC2 environment containing CORP-WEB01 and CORP-APP01 workloads inside the CORP VPC.

AWS EC2 CORP-WEB01 instance details — CORP-WEB01 EC2 instance with private address **10.10.10.133**, assigned IAM role, VPC membership, and IMDSv2 protection.

CLOUD SECURITY

Security Group Segmentation

Security groups were created according to workload role instead of applying the same access policy to every EC2 instance.

The web-server security group supports required administration and HTTP connectivity, while the private application security group uses a more restrictive inbound policy.

AWS security groups for public web server and private application server — Separate security groups for the public web server and private application server, supporting workload-specific access control.

HYBRID CONNECTIVITY

AWS Site-to-Site VPN

AWS Site-to-Site VPN securely connects the local pfSense firewall to the AWS Virtual Private Gateway.

AWS provides two VPN tunnels for the connection. Both endpoints were configured in pfSense to provide redundant encrypted paths.

Customer Gateway

pfSense represents the on-premises side of the AWS Site-to-Site VPN connection.

Virtual Private Gateway

AWS Virtual Private Gateway provides the cloud-side VPN termination point for the CORP VPC.

IPsec

Traffic between environments is encrypted through IPsec tunnels across the public network.

Static Routing

Routes direct on-premises and AWS traffic through the hybrid VPN connection.

AWS Site-to-Site VPN showing both tunnels up — AWS Site-to-Site VPN connection showing both AWS tunnel endpoints in an Up state.

pfSense IPsec Validation

Tunnel status was also validated directly from pfSense rather than relying only on the AWS console.

pfSense showing AWS Tunnel 1 and AWS Tunnel 2 established — pfSense IPsec status showing both **AWS Tunnel 1** and **AWS Tunnel 2** established.

RESILIENCY

VPN Redundancy & Failover Testing

The dual-tunnel design provides a second VPN path when one tunnel is unavailable.

Tunnel state was observed during validation to verify that the secondary connection could remain available independently of the primary path.

pfSense AWS VPN tunnel failover validation — VPN tunnel-state validation from pfSense during redundancy and connectivity testing.

CONNECTIVITY VALIDATION

On-Premises to AWS Private Connectivity

Establishing the VPN tunnel was only part of the test. I also validated real application connectivity across the hybrid network.

DC01 on the on-premises network successfully connected to the AWS web server at private address 10.10.10.133 on TCP port 80.

PowerShell Test-NetConnection successfully reaching private AWS web server — PowerShell validation from on-premises DC01 showing successful TCP connectivity to **10.10.10.133:80** across the Site-to-Site VPN.

Private Web Application Access

The private AWS address was also tested at the application layer from the on-premises environment.

On-premises browser reaching AWS web server using private address 10.10.10.133 — CORP AWS Web Server reached from the on-premises environment through the private AWS address **10.10.10.133**.

EC2 Administration

Administrative access to the Linux EC2 workload was validated using SSH and key-based authentication.

SSH connection from Windows PowerShell to Amazon Linux EC2 — Successful SSH administration session from Windows PowerShell to the Amazon Linux EC2 instance.

IDENTITY & ACCESS MANAGEMENT

AWS IAM Security

IAM was used to support service permissions and improve account security instead of embedding long-lived credentials into cloud workloads.

The environment includes IAM roles for AWS resources, root-account MFA, and no active root access keys.

AWS IAM dashboard showing root MFA and IAM resources — IAM dashboard showing root MFA enabled, no active root access keys, IAM roles, and account security recommendations.

S3 Storage

Amazon S3 was incorporated into the environment for project storage and CloudTrail log retention.

Amazon S3 buckets including CloudTrail logging bucket — S3 resources including the project storage bucket and the AWS CloudTrail log bucket.

AUDITING

CloudTrail Activity Logging

AWS CloudTrail was enabled to provide an audit trail of management-plane activity inside the AWS environment.

This provides visibility into infrastructure changes such as VPN creation, gateway attachment, routing changes, and monitoring configuration.

AWS CloudTrail dashboard and event history — CloudTrail logging with event history showing actions associated with VPN, routing, and monitoring configuration.

MONITORING

CloudWatch Monitoring & Alarms

Amazon CloudWatch was configured to provide operational visibility into EC2 workloads and alert on abnormal resource conditions.

CPU Monitoring

CPU utilization metrics provide visibility into compute workload behavior.

Network Monitoring

NetworkIn and NetworkOut metrics help track traffic activity on cloud workloads.

Status Checks

EC2 status-check alarms support detection of infrastructure or instance failures.

Threshold Alarms

Resource thresholds can trigger alarms when utilization exceeds defined limits.

AWS CloudWatch dashboard showing EC2 metrics and alarms — CloudWatch EC2 monitoring with CPU, network, status-check metrics, and configured alarms.

Hybrid Security Model

On-Premises Infrastructure
        |
        v
pfSense Firewall
        |
        +---- Firewall Policy
        |
        +---- Site-to-Site IPsec
        |
        v
AWS Virtual Private Gateway
        |
        v
CORP-VPC
10.10.0.0/16
        |
        +-------------------------------+
        |                               |
        v                               v
Public Subnet                     Private Subnet
        |                               |
        v                               v
Public EC2                       Private EC2
        |                               |
        +---------------+---------------+
                        |
                        v
                 Security Groups
                        |
                        v
                  IAM Permissions
                        |
             +----------+----------+
             |                     |
             v                     v
         CloudTrail             CloudWatch
          Audit Logs          Metrics / Alarms
             |
             v
             S3

Validation Summary

AWS VPN Tunnel 1

VALIDATED
Tunnel successfully established.

AWS VPN Tunnel 2

VALIDATED
Secondary tunnel successfully established.

Private TCP Connectivity

PASS
On-premises host reached AWS private IP over TCP port 80.

Private Web Access

PASS
AWS web application accessible across the hybrid VPN.

EC2 Administration

PASS
SSH connectivity to Amazon Linux successfully validated.

Cloud Monitoring

OPERATIONAL
CloudTrail and CloudWatch provide audit and operational visibility.

Troubleshooting & Engineering Experience

Building the hybrid environment required troubleshooting across cloud networking, VPN negotiation, routing, access control, compute, and monitoring.

IPsec Negotiation

Validated Phase 1 and Phase 2 tunnel state across pfSense and AWS.

Hybrid Routing

Verified routing between 172.16.x.x on-premises networks and the AWS 10.10.0.0/16 VPC.

Security Groups

Adjusted cloud access policies to permit required application and administrative traffic.

EC2 Connectivity

Tested HTTP and SSH connectivity using service-specific tools.

Monitoring

Configured CloudWatch metrics and alarms and validated CloudTrail event logging.

Redundancy

Validated both AWS-provided VPN tunnels and observed tunnel behavior during testing.

Final Results

Hybrid Network

Working on-premises-to-AWS connectivity through pfSense Site-to-Site IPsec VPN.

Redundant Tunnels

Both AWS VPN tunnel endpoints configured and successfully established.

Segmented AWS Network

Public and private cloud workloads separated inside a dedicated VPC.

Cloud Security

Security groups, IAM roles, root MFA, and IMDSv2 applied.

Operational Monitoring

CloudWatch metrics and alarms provide visibility into EC2 workload health.

Audit Logging

CloudTrail records AWS management actions and stores audit data in S3.

Skills Demonstrated

AWS Hybrid Cloud VPC Subnets Route Tables Internet Gateway EC2 Amazon Linux SSH pfSense Site-to-Site VPN IPsec IKEv2 TCP/IP Routing Network Segmentation Security Groups IAM IAM Roles MFA IMDSv2 Amazon S3 CloudTrail CloudWatch Cloud Monitoring High Availability VPN Redundancy PowerShell Connectivity Testing Troubleshooting Technical Documentation

Full Technical Documentation

The GitHub repository contains additional implementation details, AWS configuration evidence, networking documentation, VPN setup, testing results, troubleshooting notes, and supporting project documentation.

View GitHub Repository Back to Projects