AWS
Reach a private VPC, open nothing
One EC2 instance runs the agent and dials out. No inbound rule, no Elastic IP, no public subnet. Name what sits behind it, then allow it in a rule.
Free plan · No card · One instance counts as one device
The problem
A private subnet usually grows a way in
Every way into a VPC starts as a temporary exception.
A bastion in a public subnet
A jump host with an Elastic IP, an inbound rule for port 22, and an allow-list of office addresses that goes stale.
One instance that dials out
It sits in a private subnet and opens the connection itself. No inbound rule, no Elastic IP, no public subnet.
A tunnel that hands over the whole /16
The tunnel comes up and the laptop can reach every address in the VPC, including the ones nobody meant to share.
The resources, not the range
Name the database, the internal load balancer, the one instance. A rule then decides which group reaches which port.
How it works
One instance, three steps
Nothing in the VPC's routing changes, and no security group gains a rule.
Enroll one instance
A small always-on instance in a private subnet runs the agent. Enrol it with an enrollment key, so nobody has to sign in at a console.
Read moreName the resources
The instance carries traffic to what sits behind it: a host at a fixed address, a managed endpoint by name, a subnet when listing hosts one by one is impractical.
Read moreAllow it in a rule
A route on its own grants nothing. A rule names the group, the resource and the port. Everything else stays dark.
Read moreWhat you get
The security group stays as it is
Nothing inbound to open
The agent only dials out. If the instance already reaches the internet, directly or through a NAT gateway, it reaches the control plane.
Read moreInstances that come and go
An instance that lives an hour should leave no device record. A reusable enrollment key can register temporary devices, whose records are removed once they stop connecting.
Read moreMore VPCs, same rules
Another region or another account is one more instance with the agent. Same network, same rules, and no VPC peering.
Read moreFAQ
Where AWS is different
Does the instance need an Elastic IP?
No. The agent dials out, so nothing has to reach it. If the instance already has one, state the public address mapping yourself: an Elastic IP is a 1:1 NAT, so the instance's own interface carries the private address, and until you say so, tunnels that could be direct may end up relayed.
How do I reach RDS when the address moves?
Name the endpoint. The instance in the VPC resolves it from the inside and is the only machine that gets the private answer. It re-resolves on a schedule as the address changes.
What happens to autoscaled instances?
Use a reusable enrollment key that registers temporary devices. Each instance enrolls at boot, and the record is removed ten minutes after its last connection, so an hour-long instance leaves nothing behind.
Can I bake the agent into an AMI?
Install it, but do not enroll first. An image taken after enrollment carries that device's identity, so every instance launched from it claims to be the same device. Have machines enroll at first boot instead.
Should I just add the whole VPC CIDR?
Almost never. Name the addresses and names that should actually be reachable. A /16 is quicker to write and much harder to account for a year later.
Start with one instance
Enroll a small instance in a private subnet, name one database, write one rule. Terminate the instance to back it all out.
Nothing behind the route counts as a device