India’s Leading Domain & Web Hosting Provider
Support
Domain & Login
Blog
AWS VPC, Transit Gateway & Direct Connect Networking Services
Amazon VPC is the private, isolated network in which AWS resources run, and services such as AWS Transit Gateway, Site-to-Site VPN and AWS Direct Connect link many VPCs and on-premises sites into one routed network. NTSPL designs these hybrid networks for Indian manufacturers, retailers and brokers, sizing bandwidth, redundancy, DNS and firewall inspection so plants, stores and data centres reach AWS Mumbai predictably.
AWS services in scope
The Problem Amazon VPC and AWS Transit Gateway Solve
Network design is the part of an AWS landing zone that is hardest to change later. Overlapping 10.0.0.0/16 ranges copied from a tutorial, VPC peering meshes that reach 30 connections, a single VPN tunnel carrying ERP traffic from a plant, NAT gateways in every VPC and no central inspection: each choice works on day one and becomes an outage or a re-addressing project by year two. In India the extra variable is the last mile, where plant and store links vary from MPLS to 4G and redundancy depends on using different carriers.
NTSPL starts with an IP address plan in Amazon VPC IP Address Manager covering every Region, account and on-premises range, then builds a Transit Gateway hub with separate route tables for production, non-production, shared services and inspection. On-premises connectivity is sized from measured flows, with Direct Connect where throughput or jitter matters and VPN as backup or for small sites. Route 53 Resolver endpoints unify DNS, and AWS Network Firewall inspects north-south and east-west traffic where policy requires.
When to Use Transit Gateway, Direct Connect and Site-to-Site VPN (and When Not To)
Signals that point to networking & connectivity on AWS
- You have more than 8-10 VPCs connected by peering, or are about to add new accounts each quarter.
- Plant, branch or store traffic to AWS runs over a single VPN tunnel or a single carrier.
- ERP, historian or trading traffic shows latency jitter over internet VPN that users notice.
- On-premises servers cannot resolve AWS private hosted zone names, so teams hard-code IP addresses.
- Each VPC has its own NAT gateway and internet egress with no central egress filtering or logging.
- IP ranges overlap between AWS accounts, acquired companies or partner networks.
When a different approach is better
- Remote employees needing access to a few internal web applications are better served by AWS Verified Access or AWS Client VPN than by adding each home to the site-to-site network.
- A single-VPC startup with no on-premises footprint does not need Transit Gateway; well-structured subnets and VPC endpoints are enough until a second VPC appears.
- Global multi-Region WAN with dozens of Regions and SD-WAN policy managed centrally may suit AWS Cloud WAN better than hand-built Transit Gateway peering.
AWS Network Building Blocks: VPCs, Transit Gateway, VPN, Direct Connect, Route 53 and PrivateLink
| Service | Role in the architecture | Choose it when |
|---|---|---|
| Amazon VPC | Provides isolated virtual networks with subnets across Availability Zones, route tables, security groups, network ACLs, NAT gateways and VPC endpoints. | Any workload runs on AWS; the question is only how many VPCs, how they are addressed and how they connect. |
| AWS Transit Gateway | Acts as a regional router connecting VPCs, VPNs, Direct Connect gateways and SD-WAN appliances through Transit Gateway Connect, with multiple route tables for segmentation and inter-Region peering. | You have more than a handful of VPCs or on-premises sites and need central routing, segmentation and inspection instead of a peering mesh. |
| AWS Site-to-Site VPN | Creates IPsec connections with two tunnels each from customer gateways to a virtual private gateway or Transit Gateway, with BGP dynamic routing and optional acceleration over the AWS global network. | Sites need encrypted connectivity quickly over existing internet links, or a backup path for Direct Connect. |
| AWS Direct Connect | Provides private, dedicated or partner-hosted connections from your network to AWS at Direct Connect locations, giving predictable latency and throughput outside the public internet. | Sustained traffic exceeds a few hundred Mbps, jitter affects applications, or data transfer out volume makes Direct Connect pricing cheaper than internet egress. |
| Amazon Route 53 and Route 53 Resolver | Hosts public and private DNS zones with health-checked routing policies, and resolves names between on-premises and VPCs through inbound and outbound Resolver endpoints. | On-premises systems must resolve AWS private names, or applications need DNS failover and latency-based routing. |
| AWS PrivateLink | Exposes a service from one VPC to consumers in other VPCs or accounts through interface endpoints, without routing between whole networks, and gives private access to AWS services. | You need to share one service with partners, subsidiaries or other accounts that have overlapping IP ranges, or keep AWS API traffic off the internet. |
| AWS Network Firewall | Applies managed stateful and stateless inspection, domain filtering and Suricata-compatible intrusion prevention rules to traffic routed through firewall endpoints. | Policy or regulators require deep packet inspection, egress domain allow-lists or IPS between zones and to the internet. |
Hub-and-spoke Transit Gateway network with hybrid connectivity and central inspection
Hub-and-spoke Transit Gateway network with hybrid connectivity and central inspection
On-premises sites reach AWS over Direct Connect through a Direct Connect gateway, or over Site-to-Site VPN, both terminating on a Transit Gateway in ap-south-1. Transit Gateway route tables send traffic between spokes and to the internet through an inspection VPC running AWS Network Firewall, while Route 53 Resolver endpoints in a shared-services VPC resolve names in both directions.
Select any component
Hub-and-spoke Transit Gateway network with hybrid connectivity and central inspection: click any of its 9 components to see its role and the design choice NTSPL makes for it, or trace the 6-step primary path.
Network Engineering Decisions: IP Planning, Segmentation, Link Redundancy and Hybrid DNS
IP address planning
We allocate non-overlapping CIDR blocks from a single plan covering on-premises, every AWS Region and future acquisitions, managed in VPC IP Address Manager. Production VPCs typically get a /20 or /21 per Region, split into /24 or larger subnets per Availability Zone and tier. We reserve ranges for Hyderabad DR and keep secondary CIDRs available for EKS pod networking, which consumes addresses quickly.
Segmentation with Transit Gateway route tables
Instead of one flat route table, we associate each attachment with a route table by environment and propagate only the routes it may reach. Production and non-production never share a table; on-premises routes propagate into production and shared services only. Traffic needing inspection is sent to the inspection VPC by static default routes, with appliance mode enabled to keep flows symmetric across Availability Zones.
Direct Connect vs VPN and redundancy model
VPN suits sites under about 500 Mbps that tolerate internet jitter; each standard tunnel is limited to roughly 1.25 Gbps, or up to 5 Gbps with Large Bandwidth Tunnels on Transit Gateway or Cloud WAN attachments. Direct Connect suits sustained high throughput, low jitter or large egress volumes. For critical workloads we follow AWS resiliency guidance: two connections at two Direct Connect locations, or at minimum one Direct Connect plus VPN backup on a different carrier. BGP timers and Bidirectional Forwarding Detection are tuned so failover completes in seconds.
Hybrid DNS design
Route 53 Resolver inbound endpoints let on-premises DNS servers resolve AWS private zones; outbound endpoints with forwarding rules let VPCs resolve corporate domains. We deploy endpoints in a shared-services VPC with two or more Availability Zones and share rules to all accounts through AWS RAM. This removes hard-coded IPs, which are the most common cause of broken DR failovers.
Egress and endpoint strategy
Centralizing NAT and egress in an inspection VPC cuts the number of NAT gateways and gives one place for domain filtering, at the cost of Transit Gateway data processing charges. S3 and DynamoDB gateway endpoints are free and should exist in every VPC. Interface endpoints for services such as ECR, CloudWatch Logs and Secrets Manager are worth centralizing once enough VPCs use them.
How NTSPL Builds a Hybrid AWS Network from IP Plan to Cutover
Flow capture and IP plan
Measure current site-to-data-centre flows and bandwidth with NetFlow or router statistics, then build the non-overlapping CIDR plan in VPC IPAM.
Network account and Transit Gateway build
Create the Transit Gateway in a dedicated network account, define route tables and share it to workload accounts with AWS RAM.
Direct Connect and VPN provisioning
Order ports or hosted connections through a Direct Connect partner, configure virtual interfaces and BGP, and bring up VPN tunnels with BFD and tuned timers.
Hybrid DNS and inspection VPC
Deploy Resolver endpoints and forwarding rules, then the inspection VPC with Network Firewall and centralized NAT.
Site-by-site migration
Move sites in waves, advertising routes through the new path and withdrawing old ones, with Reachability Analyzer checks before each wave.
Failure drills
Shut down a Direct Connect link, a VPN tunnel and a firewall endpoint in turn and record the measured failover time for each.
What you receive
Securing AWS Networks: Segmented Route Tables, Network Firewall, Endpoints and Flow Logs
Network threats on AWS come from over-permissive routes, open security groups and uncontrolled egress used for data exfiltration. NTSPL enforces segmentation in Transit Gateway route tables, keeps workload subnets without internet gateways, filters egress by domain in AWS Network Firewall, uses PrivateLink and endpoints for AWS APIs, and logs flows centrally. Centralized flow logging also supports the CERT-In direction to retain ICT system logs for 180 days within India, which SEBI- and RBI-regulated clients are audited against.
- Transit Gateway route-table isolation so non-production cannot route to production
- AWS Network Firewall stateful domain allow-lists blocking egress to unknown destinations
- VPC endpoint policies restricting S3 access to the organization's own buckets
- VPC Flow Logs and Transit Gateway Flow Logs retained in S3 for at least 180 days
- MACsec on supported dedicated Direct Connect connections, or IPsec VPN over Direct Connect, where link-layer encryption is required
AWS Networking Pricing Levers: Attachments, Data Processing, NAT, Direct Connect Ports and Egress
AWS networking cost is driven by hourly attachment and endpoint charges plus per-GB processing: Transit Gateway charges per attachment hour and per GB processed, NAT gateways per hour and per GB, Network Firewall per endpoint hour and per GB, and Direct Connect per port hour plus data transfer out at lower rates than internet egress. Design choices on centralization move cost between these lines.
- Gateway endpoints for S3 and DynamoDB to remove NAT processing for that traffic
- Centralized NAT and egress to reduce NAT gateway count across many VPCs
- Direct Connect for high-volume egress to on-premises, priced below internet data transfer out
- Keeping chatty services in the same Availability Zone where design allows, to cut cross-AZ transfer
- Right-sizing hosted Direct Connect capacity from measured peak rather than estimate
AWS Direct Connect vs Site-to-Site VPN: which should connect my offices to AWS?
Decide on four criteria. Throughput: a standard VPN tunnel tops out around 1.25 Gbps (up to 5 Gbps with Large Bandwidth Tunnels on Transit Gateway or Cloud WAN), while Direct Connect offers 1, 10, 100 and 400 Gbps dedicated ports, or smaller hosted capacities through partners. Consistency: VPN rides the internet, so latency and jitter vary; Direct Connect is a private path with predictable performance. Lead time: VPN is configured in an hour; Direct Connect takes days to weeks to provision through a partner and carrier. Cost: VPN is cheap per hour but egress is billed at internet rates; Direct Connect has port charges but lower data transfer rates, so it pays off at high volumes. Most Indian enterprises use Direct Connect for data centres and large plants and VPN for small sites and as backup.
Key facts about networking & connectivity on AWS
Networking & Connectivity on AWS in Practice
3 networking & connectivity scenarios from Specialty chemicals manufacturing, Retail (grocery and general merchandise chain), Capital markets (stock broking): the starting position, the services chosen, the architecture, the rollout and the measured outcome.
Specialty chemicals group links 6 plants and HQ to AWS with dual-path hybrid network
Retail chain connects 420 stores' POS to AWS through SD-WAN and Transit Gateway Connect
Stock broker builds dual-location Direct Connect for trading apps with sub-second failover
Auto components maker cuts CAE simulation queue from 3 days to 6 hours with Spot bursts
EPC contractor consolidates 11 site file servers and 380 TB of drawings onto FSx and S3
Diagnostics chain tiers 1.4 PB of medical imaging and cuts archive cost by 63%
NBFC moves loan-origination Oracle database to Aurora PostgreSQL and drops EE licences
Payments fintech moves card-processing services to ECS Fargate and narrows PCI DSS scope
Networking & Connectivity on AWS: Frequently Asked Questions
How is AWS Transit Gateway billed?
Transit Gateway charges for each attachment per hour, such as each VPC, VPN or Direct Connect gateway attachment, plus a per-GB charge for data processed. Inter-Region peering also incurs data transfer charges. For estates with many VPCs it is usually simpler and cheaper to operate than a peering mesh, but heavy east-west traffic should be modelled first.
Where can we connect AWS Direct Connect in India?
AWS Direct Connect has locations in India in several major cities, served by carriers and Direct Connect partners who can provide hosted connections from your premises. NTSPL checks current locations and partner options for each site, and for critical workloads designs connections at two separate locations so a single facility failure does not cut access.
How do we move from an MPLS network to AWS connectivity without disruption?
We bring up AWS connectivity alongside the existing MPLS, advertise AWS routes over BGP and migrate sites in waves. Traffic preference is controlled with BGP attributes, so each site can be moved and rolled back quickly. MPLS is retired only after each wave has run through a month-end or peak period.
Does our trading or banking data leave India when we use AWS networking?
Not unless you route it out. VPCs, Transit Gateways and Direct Connect gateways you deploy in Asia Pacific (Mumbai) and Asia Pacific (Hyderabad) keep traffic between your sites and those Regions within the AWS network. This supports data localization expectations from SEBI and RBI and the DPDP Act 2023, but you must avoid inter-Region peering to Regions abroad for regulated data.
Can we connect hundreds of branch sites to AWS?
Yes. Large branch estates usually terminate on Transit Gateway either as individual Site-to-Site VPN connections or through an SD-WAN vendor's virtual appliances attached with Transit Gateway Connect, which uses GRE and BGP for higher throughput per attachment. The right option depends on the existing SD-WAN and the per-site bandwidth needed.
How fast does failover happen between Direct Connect and VPN?
With Bidirectional Forwarding Detection enabled on Direct Connect and tuned BGP timers, failure detection takes well under a second to a few seconds, and traffic moves to the backup path shortly after. Without BFD, default BGP hold timers can take around 90 seconds. NTSPL measures failover in a live drill as part of handover.