Cisco AnyConnect, while a commercial implementation, is incredibly hard to filter by firewalls (including those in China) because it works over HTTPS (and very

Cisco AnyConnect, while a commercial implementation, is incredibly hard to filter by firewalls (including those in China) because it works over HTTPS (and very few people/countries outright block HTTPS), while IPSec is fairly detectable. I agree that while VPNs are painful to setup, the results are worth it and can really simplify access to protected systems, such as not even exposing services like SSH to the public network. Commercial hardware VPN routers have a very good track record--avoid software VPNs if you can (or use dd-wrt if cost is an issue). What's more is AWS also supports connecting to a VPN router. It may be worth it to co-lo a VPN router and access protected assets (including AWS) via a VPN router (you can of course serve public facing traffic directly from AWS).