Zero-Trust Hybrid Cloud: Connecting AWS VPC to On-Premise Proxmox with Tailscale Subnet Routers

Connecting on-premise physical servers (like Proxmox or bare-metal racks) to cloud providers like AWS has traditionally required expensive AWS Direct Connect or complex IPSec VPN tunnels with dedicated hardware firewalls. These setups are brittle, hard to debug, and cost hundreds of dollars per month in AWS VPN connection fees.

By deploying Tailscale Subnet Routers powered by the kernel-level WireGuard protocol, you can build an encrypted, mesh-routed hybrid cloud in under 15 minutes with zero ongoing network gateway fees.

Architecture Overview

We deploy a lightweight Debian LXC container on Proxmox and an EC2 instance in the AWS private subnet. Both act as Tailscale Subnet Routers, advertising their respective private CIDRs (192.168.10.0/24 on-prem and 10.0.0.0/16 in AWS).

Enabling Kernel IP Forwarding and WireGuard on Proxmox LXC

# Enable packet forwarding in sysctl
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

# Start Tailscale and advertise the on-premise subnet
sudo tailscale up --advertise-routes=192.168.10.0/24 --accept-routes

Now, any container in your Proxmox homelab can communicate directly with private RDS databases or Kubernetes pods in AWS using internal private IPs with sub-millisecond WireGuard crypto overhead.