An enterprise-style hybrid cloud build connecting an on-prem home lab to AWS through a dedicated Transit VPC, a FortiGate Network Virtual Appliance, AWS Transit Gateway, and dynamic routing over IPsec — designed as a reusable network hub, not a one-off VPN tunnel.
Enterprise-inspired hybrid networking architecture using AWS Transit Gateway, FortiGate NVA, IPsec VTI and eBGP.
This project demonstrates an enterprise-inspired hybrid cloud architecture that securely connects an on-premises environment to AWS using a dedicated Transit VPC, a FortiGate Network Virtual Appliance (NVA), AWS Transit Gateway, Route-Based IPsec VPN, and dynamic eBGP routing. Rather than building a simple point-to-point VPN, the design focuses on scalability, centralized security, and reusable network services commonly found in enterprise environments.
Most home-lab hybrid cloud setups terminate a VPN straight into an application VPC. It works, but it doesn't scale — every new workload means another tunnel, another route, another one-off decision.
This build separates network infrastructure from application infrastructure. A dedicated Transit VPC acts as the network services layer, with a FortiGate VM running inside it as the Network Virtual Appliance — handling routing and security centrally — while AWS Transit Gateway fans connectivity out to application VPCs as they're added.
The first workload riding on this hub is an AdGuard Home instance, providing secondary DNS resolution back to the home lab. The point isn't the DNS server — it's that the next VPC just attaches to the Transit Gateway, with no redesign required.
Traffic leaves the home lab over a route-based IPsec tunnel, lands on the FortiGate NVA inside the Transit VPC, and is handed to Transit Gateway for distribution to every attached VPC.
Routes are exchanged dynamically instead of statically — when an advertised prefix changes on either side, both ends learn it automatically.
A VPN dropped straight into an application VPC is a common lab pattern — it just doesn't hold up once more than one workload needs access.
The Transit VPC is a dedicated network services layer. Application workloads stay isolated from VPN termination and routing infrastructure.
All hybrid traffic traverses the FortiGate firewall — one place for policy enforcement, logging, inspection, and future IPS/IDS.
Future VPCs simply attach to the Transit Gateway. No additional VPN tunnels, no re-architecture — the same tunnel securely serves every attached VPC.
Mirrors how larger orgs actually do this — dedicated network hubs rather than VPNs terminated straight into workload VPCs, as seen in MSPs, financial institutions, and multi-account AWS Organizations.
Native AWS Site-to-Site VPN is solid, but it gives limited control over inspection and advanced routing. A FortiGate NVA trades a bit of simplicity for:
Live configuration and status output pulled directly from the on-prem and AWS sides of the tunnel.
Designed the Transit VPC, AWS Transit Gateway topology, IP addressing, and hybrid connectivity strategy.
Configured FortiGate NVA, Route-Based IPsec VPN, eBGP peering, VPC route tables, and deployed the Amazon Linux AdGuard workload.
Verified dynamic route exchange, end-to-end connectivity, hybrid DNS resolution, and documented the complete architecture.