Happy to help although it was ~3 years ago I set this up and it uses openVPN as I have not switched over to Wireguard yet (been meaning to). I do recall that s

Happy to help although it was ~3 years ago I set this up and it uses openVPN as I have not switched over to Wireguard yet (been meaning to). I do recall that setting up port forwarding and NAT and both sides was the biggest pain (I do not regularly do network admin!), exacerbated by the fact that the client side is smartOS which uses a different system (ipfilter) than linux (iptables) so there were two cryptic network filtering DSLs to learn. The VPN part was relatively easy as it's just a point to point connection with the local machine as the client, configured to reconnect when the connection is lost and on boot. On the ec2 side this is (approximately) my iptables setup (1234 and 5678 are stand-ins for ports I use to ssh into the local machine from anywhere on the internet, I have two because there are multiple (smartOS/Solaris) zones on the machine): sudo iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT tcp -- anywhere anywhere tcp dpt:https ACCEPT tcp -- anywhere anywhere tcp dpt:1234 ACCEPT tcp -- anywhere anywhere tcp dpt:5678 Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT tcp -- anywhere ip-10-4-0-2.ec2.internal tcp dpt:http ACCEPT tcp -- anywhere ip-10-4-0-2.ec2.internal tcp dpt:https ACCEPT tcp -- anywhere ip-10-4-0-2.ec2.internal tcp dpt:1234 ACCEPT tcp -- anywhere ip-10-4-0-2.ec2.internal tcp dpt:5678 Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp spt:http On the ec2 side, openvpn conf: dev tun1 ifconfig 10.4.0.1 10.4.0.2 verb 5 secret local.key cipher AES-256-CBC keepalive 10 60 persist-tun persist-key On the local side, openvpn: remote [ec2 ip adr here] dev tun1 ifconfig 10.4.0.2 10.4.0.1 verb 5 secret ec2.key cipher AES-256-CBC keepalive 10 60 persist-tun persist-key On the local side, ipf conf in ipnat.conf. This is abbreviated as most of the stuff in there is just forwarding amid the zones which is not relevant to a simple linux setup without zones. In addition to figuring out the iptables equivalent I believed you'd want to replace the 102 adr (which in this case is a zone) with your local machine (like 0.0.0.0/0 or whatever): map net0 10.0.0.102/32 -> 0/32 map tun1 10.0.0.102/32 -> 10.4.0.2 (not sure if the first line is even relevant or not, it's been a while)