{"id":82086,"date":"2026-09-07T11:28:40","date_gmt":"2026-09-07T05:58:40","guid":{"rendered":"https:\/\/www.tothenew.com\/blog\/?p=82086"},"modified":"2026-09-09T10:43:31","modified_gmt":"2026-09-09T05:13:31","slug":"deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources","status":"publish","type":"post","link":"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/","title":{"rendered":"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources"},"content":{"rendered":"<h2>Introduction<\/h2>\n<p>When designing cloud solutions in AWS, one has to make a choice between secure isolation and accessibility. The recommended practice is to place all application servers, databases, and internal API&#8217;s in a private subnet and deny their access to the Internet. But then, how can developers, operations engineers, and system administrators access these resources to do their work?<\/p>\n<p>A more secure and private option is to setup a client-to-site VPN. By deploying a VPN server in a public subnet and allowing the clients to connect to it, one can provide the users with the secure entrance to the private subnet. The Pritunl is a popular open-source VPN server that runs on the OpenVPN and WireGuard stacks. It provides a nice Web UI, Active Directory\/SAML support, and easy routing configuration. In this article, I am going to demonstrate how to configure the Pritunl VPN to allow the client access to the AWS resources over the encrypted channel. We will setup a Ubuntu 24.04 LTS instance on AWS and configure the necessary routing tables.<\/p>\n<h3>What is Pritunl?<\/h3>\n<p>Pritunl is a management layer over the OpenVPN protocol (Wireguard support in enterprise plans). In other words, instead of manually generating certificates and fiddling with text-based server.conf files, you get to use a nice web interface\/API to manage users, organizations, and routes.<\/p>\n<p>It operates on a traditional VPN server\/client model:<\/p>\n<ul>\n<li><strong>The Server:<\/strong> Runs on a Linux instance, listening on a specific UDP or TCP port.<\/li>\n<li><strong>The Client:<\/strong> A lightweight application installed on the user&#8217;s local machine (macOS, Windows, or Linux) that establishes an encrypted tunnel to the server.<\/li>\n<li><strong>The Network:<\/strong> Once authenticated, the server assigns the client a virtual IP address. The client&#8217;s routing table is updated to send specific traffic (like your AWS VPC CIDR) into the tunnel.<\/li>\n<\/ul>\n<h3>Why Use Pritunl in AWS?<\/h3>\n<p>A well-configured VPN is the basis for secure administration. Pritunl in AWS is used by teams for the following purposes:<\/p>\n<ul>\n<li>Accessing internal UIs: Exposing private web UIs (e.g., Grafana, ArgoCD, internal Jenkins) without having to configure a reverse proxy.<\/li>\n<li>Administering databases: Accessing RDS instances using standard local GUI clients (e.g., DBeaver or pgAdmin).<\/li>\n<li>SSH\/RDP access: Directly connecting to the private IP of EC2 instances (over SSH and RDP).<\/li>\n<li>Secure testing of APIs: Directly hitting endpoints of internal applications on a developer&#8217;s local Postman or curl.<\/li>\n<\/ul>\n<p>While a VPN encrypts traffic on a public internet, it does not make an architecture secure. It should be noted that the lateral movement is allowed by default if not explicitly denied. The proper way to design the VPC and use the AWS security groups in combination with the least privilege principles is of utmost importance.<\/p>\n<div id=\"attachment_82088\" style=\"width: 1034px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-82088\" class=\"size-full wp-image-82088\" src=\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/pritunl.jpeg\" alt=\"Conceptual Hybrid Diagram showing Pritunl Server in Public Subnet connecting to Authorized Private Subnets\" width=\"1024\" height=\"588\" srcset=\"\/blog\/wp-ttn-blog\/uploads\/2026\/09\/pritunl.jpeg 1024w, https:\/\/www.tothenew.com\/blog\/wp-content\/uploads\/2026\/09\/pritunl-300x172.jpeg 300w, https:\/\/www.tothenew.com\/blog\/wp-content\/uploads\/2026\/09\/pritunl-768x441.jpeg 768w, https:\/\/www.tothenew.com\/blog\/wp-content\/uploads\/2026\/09\/pritunl-624x358.jpeg 624w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><p id=\"caption-attachment-82088\" class=\"wp-caption-text\">Pritunl VPN<\/p><\/div>\n<h3>AWS Architecture<\/h3>\n<p>In order to understand how the deployment will take place, it is important to note that the traffic flow should be mapped. In this case, the Pritunl server will be placed in a public subnet with EIP attached, which is required for a constant public IP address, while the application and database will be in a private subnet.<\/p>\n<h4>Reference Diagram<\/h4>\n<div id=\"attachment_82089\" style=\"width: 1034px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-82089\" class=\"size-full wp-image-82089\" src=\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/aws_architecture.jpeg\" alt=\"Reference Diagram showing Traffic Flow and Routing in AWS VPC with Pritunl Client and Server\" width=\"1024\" height=\"559\" srcset=\"\/blog\/wp-ttn-blog\/uploads\/2026\/09\/aws_architecture.jpeg 1024w, https:\/\/www.tothenew.com\/blog\/wp-content\/uploads\/2026\/09\/aws_architecture-300x164.jpeg 300w, https:\/\/www.tothenew.com\/blog\/wp-content\/uploads\/2026\/09\/aws_architecture-768x419.jpeg 768w, https:\/\/www.tothenew.com\/blog\/wp-content\/uploads\/2026\/09\/aws_architecture-624x341.jpeg 624w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><p id=\"caption-attachment-82089\" class=\"wp-caption-text\">AWS Architecture<\/p><\/div>\n<h4>Traffic Flow Explained<\/h4>\n<ol>\n<li>The user opens their preferred Pritunl client and connects to our EIP on UDP 1194.<\/li>\n<li>Pritunl authenticates the user and provides them with a virtual IP address from an isolated VPN pool (e.g., 10.10.0.15).<\/li>\n<li>The user requests internal resources (e.g., the web application at 10.0.2.50).<\/li>\n<li>The packet reaches the Pritunl EC2 instance through the encrypted VPN tunnel.<\/li>\n<li>Pritunl decrypts the packet and forwards it to the VPC.<\/li>\n<li>The traffic reaches the relevant EC2\/RDS instance, which then processes it according to the inbound security group rules.<\/li>\n<li>The response packet follows the same path back to the user&#8217;s device, having been encrypted once more by the Pritunl instance.<\/li>\n<\/ol>\n<h3>Deploy the Ubuntu 24.04 EC2 Instance<\/h3>\n<p>Once the instance is created, make sure to purchase an AWS Elastic IP and bind it to the instance. Otherwise, each time the instance reboots, its Public IP address will change, disrupting all your VPN clients.<\/p>\n<h3>Ubuntu 24.04 Installation Script<\/h3>\n<p>Pritunl needs MongoDB to store configuration data. As we are using Ubuntu 24.04, let&#8217;s make sure to get the right packages and GPG keys from the repository. SSH into our new instance and let&#8217;s get started with the below script. Please note that you always want to double-check scripts from the vendors&#8217; documentation before using them in production.<\/p>\n<pre><code>#!\/bin\/bash\r\n# Reference Installation Script for Pritunl on Ubuntu 24.04 LTS\r\n# Based on current docs.pritunl.com deployment standards\r\n\r\n#1. Update base system and install prerequisites\r\nsudo apt-get update\r\nsudo apt-get upgrade -y\r\nsudo apt-get install -y curl gnupg2 wget unzip\r\n\r\n#2. Add MongoDB 7.0 repository and GPG key\r\ncurl -fsSL https:\/\/www.mongodb.org\/static\/pgp\/server-7.0.asc | \\\r\nsudo gpg -o \/usr\/share\/keyrings\/mongodb-server-7.0.gpg-dearmor\r\necho \"deb [ arch=amd64, arm64\r\nsigned-by=\/usr\/share\/keyrings\/mongodb-server-7.0.gpg ]\r\nhttps:\/\/repo.mongodb.org\/apt\/ubuntu noble\/mongodb-org\/7.0\r\nmultiverse\" | \\\r\nsudo tee \/etc\/apt\/sources.list.d\/mongodb-org-7.0.list\r\n\r\n#3. Add Pritunl repository and GPG key\r\ncurl -fsSL\r\nhttps:\/\/raw.githubusercontent.com\/pritunl\/pgp\/master\/pritunl_repo_p\r\nub.asc\r\nsudo gpg -o \/usr\/share\/keyrings\/pritunl.gpg --dearmor\r\necho \"deb [ signed-by=\/usr\/share\/keyrings\/pritunl.gpg ]\r\nhttps:\/\/repo.pritunl.com\/stable\/apt noble main\" | \\\r\nsudo tee \/etc\/apt\/sources.list.d\/pritunl.list\r\n\r\n#4. Update apt cache and install MongoDB and Pritunl\r\nsudo apt-get update\r\nsudo apt-get install -y mongodb-org pritunl\r\n\r\n#5. Enable and start services\r\nsudo systemctl enable mongod pritunl\r\nsudo systemctl start mongod pritunl<\/code><\/pre>\n<h3>Pritunl Initial Configuration<\/h3>\n<p>With the services up and running, we need to do some final setup procedure using the web interface. First, let&#8217;s generate a setup key from within the command line:<\/p>\n<pre><code>sudo pritunl setup-key<\/code><\/pre>\n<p>Copy this key, and then head over to your web browser and paste the key in the address bar right after https:\/\/. So it should look something like this: https:\/\/ (you may see a warning about SSL certificate not being valid, which is completely normal since Pritunl uses a self-signed certificate by default). Now, paste the setup key that you copied earlier in the setup key field and click save. Make sure to leave the MongoDB URI field empty or set to default (mongodb:\/\/localhost:27017\/pritunl). Finally, type the following command in the terminal:<\/p>\n<pre><code>sudo pritunl default-password<\/code><\/pre>\n<p>Use the obtained username and password to log in to the Pritunl server. You will be asked to change the password upon the first login and optionally setup Let&#8217;s Encrypt certificate if you have set up a DNS A-record pointing to your server&#8217;s elastic IP (which you should).<\/p>\n<p>In the Pritunl UI, you need to head to the Users tab and create an Organization (e.g., Engineering). Then we will create a User (e.g., alice) in this Organization. Next, we will head to the Servers tab and click Add Server.<\/p>\n<ul>\n<li>Name: AWS-Gateway<\/li>\n<li>Port: 1194<\/li>\n<li>Protocol: udp<\/li>\n<li>Virtual Network: 10.10.0.0\/24<\/li>\n<\/ul>\n<p>Attach your Organization to this Server. Now we need to click on the Routes configuration for the server. Here we need to ensure that the 10.0.0.0\/16 route is added. This tells the VPN client, &#8220;When you want to reach an IP starting with 10.0, send it through the VPN tunnel.&#8221;<\/p>\n<h3>Configure a Private EC2 Application<\/h3>\n<p>Let&#8217;s put it all together. Let&#8217;s say there&#8217;s an internal monitoring application running on 10.0.2.50 inside your private subnet. Because it has no public IP, it can&#8217;t be reached from the web. However, because you&#8217;ve setup the tunnel and allowed connections from the Pritunl Security Group to the Application Security Group, a connected engineer just needs to open their browser to http:\/\/10.0.2.50:8080, and the traffic will be magically tunneled in.<\/p>\n<h3>Configure Private Database Access<\/h3>\n<p>Databases are the crown jewels of your cloud environment. Always make sure to put RDS instances in a private subnet, unmapped to a public IP address. Let&#8217;s say you have a PostgreSQL RDS instance safely locked away in 10.0.3.0\/24. Take note of the private DNS endpoint for the instance (e.g. mydb.xyz.us-east-1.rds.amazonaws.com). In the Security Group for the RDS instance, allow an Inbound Rule for TCP 5432 coming from the Pritunl Security Group. When the user resolves the private DB name, AWS Route 53 will return the private IP (e.g. 10.0.3.100). The traffic will then be nicely tunneled in, and the engineer can connect their pgAdmin instance.<\/p>\n<h3>Client Configuration<\/h3>\n<p>The process of giving access is rather easy. All that is needed is to be done in the Users tab of the Pritunl dashboard. There, a link to the profile needs to be generated and sent to the engineer. The latter, in their part, has to download the Pritunl Client (or any OpenVPN client of their choice) for either macOS, Windows, or Linux, paste the link to the ovpn profile to import it, and connect to the instance. When successfully connected, the engineer can check their local routing table to ensure everything is set up correctly. Ideally, they should get a 10.10.0.x IP address and have entries of the 10.0.0.0\/16 network and the virtual IP pool in the routing table.<\/p>\n<h2>Conclusion<\/h2>\n<p>The use of the Pritunl service running on the Ubuntu EC2 instance is a great way to allow the developers to have secure access to the AWS resources. By deploying it on the public subnet while keeping the apps behind the private ones, you get the much-needed balance between security and convenience.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction When designing cloud solutions in AWS, one has to make a choice between secure isolation and accessibility. The recommended practice is to place all application servers, databases, and internal API&#8217;s in a private subnet and deny their access to the Internet. But then, how can developers, operations engineers, and system administrators access these resources [&hellip;]<\/p>\n","protected":false},"author":2342,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":1,"footnotes":""},"categories":[5877],"tags":[248,6403,2560],"class_list":["post-82086","post","type-post","status-publish","format-standard","hentry","category-msp","tag-aws","tag-pritunl","tag-vpn"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"Introduction When designing cloud solutions in AWS, one has to make a choice between secure isolation and accessibility. The recommended practice is to place all application servers, databases, and internal API&#039;s in a private subnet and deny their access to the Internet. But then, how can developers, operations engineers, and system administrators access these resources\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Anurag Gupta\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"TO THE NEW BLOG\" \/>\n\t\t<meta property=\"og:type\" content=\"blog\" \/>\n\t\t<meta property=\"og:title\" content=\"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources | TO THE NEW Blog\" \/>\n\t\t<meta property=\"og:description\" content=\"Introduction When designing cloud solutions in AWS, one has to make a choice between secure isolation and accessibility. The recommended practice is to place all application servers, databases, and internal API&#039;s in a private subnet and deny their access to the Internet. But then, how can developers, operations engineers, and system administrators access these resources\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.tothenew.com\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.tothenew.com\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@tothenew\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources | TO THE NEW Blog\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Introduction When designing cloud solutions in AWS, one has to make a choice between secure isolation and accessibility. The recommended practice is to place all application servers, databases, and internal API&#039;s in a private subnet and deny their access to the Internet. But then, how can developers, operations engineers, and system administrators access these resources\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.tothenew.com\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\\\/#article\",\"name\":\"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources | TO THE NEW Blog\",\"headline\":\"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources\",\"author\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/author\\\/anurag-gupta1\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/wp-ttn-blog\\\/uploads\\\/2026\\\/09\\\/pritunl.jpeg\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\\\/#articleImage\"},\"datePublished\":\"2026-09-07T11:28:40+05:30\",\"dateModified\":\"2026-09-09T10:43:31+05:30\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\\\/#webpage\"},\"articleSection\":\"MSP, aws, Pritunl, VPN\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.tothenew.com\\\/blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/category\\\/msp\\\/#listItem\",\"name\":\"MSP\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/category\\\/msp\\\/#listItem\",\"position\":2,\"name\":\"MSP\",\"item\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/category\\\/msp\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\\\/#listItem\",\"name\":\"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\\\/#listItem\",\"position\":3,\"name\":\"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/category\\\/msp\\\/#listItem\",\"name\":\"MSP\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/#organization\",\"name\":\"TO THE NEW Blog\",\"url\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/author\\\/anurag-gupta1\\\/#author\",\"url\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/author\\\/anurag-gupta1\\\/\",\"name\":\"Anurag Gupta\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\\\/#authorImage\",\"url\":\"https:\\\/\\\/newersworld-sf-static.tothenew.net\\\/prod\\\/profilePicFolder\\\/f5a5d17e-567a-4409-a754-02d4c31f80bb_Anurag-Gupta-Profile-Pitcure.jpeg\",\"width\":96,\"height\":96,\"caption\":\"Anurag Gupta\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\\\/#webpage\",\"url\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\\\/\",\"name\":\"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources | TO THE NEW Blog\",\"description\":\"Introduction When designing cloud solutions in AWS, one has to make a choice between secure isolation and accessibility. The recommended practice is to place all application servers, databases, and internal API's in a private subnet and deny their access to the Internet. But then, how can developers, operations engineers, and system administrators access these resources\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/author\\\/anurag-gupta1\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/author\\\/anurag-gupta1\\\/#author\"},\"datePublished\":\"2026-09-07T11:28:40+05:30\",\"dateModified\":\"2026-09-09T10:43:31+05:30\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/\",\"name\":\"TO THE NEW Blog\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.tothenew.com\\\/blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources | TO THE NEW Blog","description":"Introduction When designing cloud solutions in AWS, one has to make a choice between secure isolation and accessibility. The recommended practice is to place all application servers, databases, and internal API's in a private subnet and deny their access to the Internet. But then, how can developers, operations engineers, and system administrators access these resources","canonical_url":"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/#article","name":"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources | TO THE NEW Blog","headline":"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources","author":{"@id":"https:\/\/www.tothenew.com\/blog\/author\/anurag-gupta1\/#author"},"publisher":{"@id":"https:\/\/www.tothenew.com\/blog\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/09\/pritunl.jpeg","@id":"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/#articleImage"},"datePublished":"2026-09-07T11:28:40+05:30","dateModified":"2026-09-09T10:43:31+05:30","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/#webpage"},"isPartOf":{"@id":"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/#webpage"},"articleSection":"MSP, aws, Pritunl, VPN"},{"@type":"BreadcrumbList","@id":"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.tothenew.com\/blog#listItem","position":1,"name":"Home","item":"https:\/\/www.tothenew.com\/blog","nextItem":{"@type":"ListItem","@id":"https:\/\/www.tothenew.com\/blog\/category\/msp\/#listItem","name":"MSP"}},{"@type":"ListItem","@id":"https:\/\/www.tothenew.com\/blog\/category\/msp\/#listItem","position":2,"name":"MSP","item":"https:\/\/www.tothenew.com\/blog\/category\/msp\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/#listItem","name":"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.tothenew.com\/blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/#listItem","position":3,"name":"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources","previousItem":{"@type":"ListItem","@id":"https:\/\/www.tothenew.com\/blog\/category\/msp\/#listItem","name":"MSP"}}]},{"@type":"Organization","@id":"https:\/\/www.tothenew.com\/blog\/#organization","name":"TO THE NEW Blog","url":"https:\/\/www.tothenew.com\/blog\/"},{"@type":"Person","@id":"https:\/\/www.tothenew.com\/blog\/author\/anurag-gupta1\/#author","url":"https:\/\/www.tothenew.com\/blog\/author\/anurag-gupta1\/","name":"Anurag Gupta","image":{"@type":"ImageObject","@id":"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/#authorImage","url":"https:\/\/newersworld-sf-static.tothenew.net\/prod\/profilePicFolder\/f5a5d17e-567a-4409-a754-02d4c31f80bb_Anurag-Gupta-Profile-Pitcure.jpeg","width":96,"height":96,"caption":"Anurag Gupta"}},{"@type":"WebPage","@id":"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/#webpage","url":"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/","name":"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources | TO THE NEW Blog","description":"Introduction When designing cloud solutions in AWS, one has to make a choice between secure isolation and accessibility. The recommended practice is to place all application servers, databases, and internal API's in a private subnet and deny their access to the Internet. But then, how can developers, operations engineers, and system administrators access these resources","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.tothenew.com\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/#breadcrumblist"},"author":{"@id":"https:\/\/www.tothenew.com\/blog\/author\/anurag-gupta1\/#author"},"creator":{"@id":"https:\/\/www.tothenew.com\/blog\/author\/anurag-gupta1\/#author"},"datePublished":"2026-09-07T11:28:40+05:30","dateModified":"2026-09-09T10:43:31+05:30"},{"@type":"WebSite","@id":"https:\/\/www.tothenew.com\/blog\/#website","url":"https:\/\/www.tothenew.com\/blog\/","name":"TO THE NEW Blog","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.tothenew.com\/blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"TO THE NEW BLOG","og:type":"blog","og:title":"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources | TO THE NEW Blog","og:description":"Introduction When designing cloud solutions in AWS, one has to make a choice between secure isolation and accessibility. The recommended practice is to place all application servers, databases, and internal API's in a private subnet and deny their access to the Internet. But then, how can developers, operations engineers, and system administrators access these resources","og:url":"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/","og:image":"https:\/\/www.tothenew.com\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png","og:image:secure_url":"https:\/\/www.tothenew.com\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png","twitter:card":"summary","twitter:site":"@tothenew","twitter:title":"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources | TO THE NEW Blog","twitter:description":"Introduction When designing cloud solutions in AWS, one has to make a choice between secure isolation and accessibility. The recommended practice is to place all application servers, databases, and internal API's in a private subnet and deny their access to the Internet. But then, how can developers, operations engineers, and system administrators access these resources","twitter:image":"https:\/\/www.tothenew.com\/blog\/wp-content\/themes\/ttn\/images\/social-logo.png"},"aioseo_meta_data":{"post_id":"82086","title":null,"description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"limit_modified_date":false,"created":"2026-09-01 19:33:41","updated":"2026-09-09 05:13:32","focus_keyword":null,"additional_keywords":null,"truseo_locale":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"breadcrumb_settings":null,"seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.tothenew.com\/blog\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.tothenew.com\/blog\/category\/msp\/\" title=\"MSP\">MSP<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tDeploying the Pritunl VPN on AWS to Access the Private Subnet Resources\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.tothenew.com\/blog"},{"label":"MSP","link":"https:\/\/www.tothenew.com\/blog\/category\/msp\/"},{"label":"Deploying the Pritunl VPN on AWS to Access the Private Subnet Resources","link":"https:\/\/www.tothenew.com\/blog\/deploying-the-pritunl-vpn-on-aws-to-access-the-private-subnet-resources\/"}],"_links":{"self":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/82086","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/users\/2342"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/comments?post=82086"}],"version-history":[{"count":4,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/82086\/revisions"}],"predecessor-version":[{"id":82195,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/82086\/revisions\/82195"}],"wp:attachment":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/media?parent=82086"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/categories?post=82086"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/tags?post=82086"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}