Hybrid Interconnect: Linking a Datacenter to AWS with WireGuard When Direct Connect Is Out of Budget
Direct Connect is the right answer when you need deterministic latency, committed bandwidth and a contractual SLA. It is also a 3-month lead time, a cross-connect fee, a port charge starting around $220/month for a 1 Gbps hosted connection, and usually a second one for redundancy. Plenty of teams need a reliable hybrid link, not a dedicated one, and they need it next Tuesday. This article walks…
Direct Connect is the preferred choice for teams requiring deterministic latency, committed bandwidth, and a contractual Service Level Agreement (SLA). However, it comes with a 3-month lead time, cross-connect fees, and port charges starting at around $220/month for a 1 Gbps hosted connection, often requiring a second port for redundancy.
Many organizations need a reliable hybrid link but want it set up quickly. This article explores a production-grade alternative using two redundant WireGuard tunnels between an on-premise datacenter and an AWS Transit Gateway, with BGP via FRRouting for dynamic routing and sub-second failover. It covers sizing, MTU calculations, AWS-side setup, OpenShift cluster configurations, and how to test failover effectively.
Before building a custom solution, consider AWS Site-to-Site VPN first. It offers similar features, including BGP, at a lower cost (~$36/month) and does not have the same lead time. WireGuard interconnects are suitable when throughput per flow exceeds ~1.25 Gbps per tunnel, crypto and key control require custom management, multi-cloud symmetry is needed, or Kubernetes clusters utilize WireGuard for pod-level encryption. If none of these criteria apply, using AWS's VPN service is recommended.
The architecture involves two WireGuard appliances in AWS, each in separate Availability Zones within a dedicated Transit VPC. On-premise, there are two gateways in different racks, ideally behind different internet service providers. While four tunnels in a full mesh setup is tempting, two tunnels (connecting DC-GW-A to AWS-GW-A and DC-GW-B to AWS-GW-B) with BGP is simpler and sufficient.
The critical aspect is how AWS appliances inject routes into the Transit Gateway. Plain EC2 instances cannot BGP-peer with a TGW, but Transit Gateway Connect can address this by exposing a GRE transport over an existing VPC attachment and running BGP inside it, turning two EC2 boxes into a dynamic hybrid edge.
On the on-prem side, the network ranges are 10.10.0.0/16, with internet access through the TGW. The on-prem gateways, DC-GW-A and DC-GW-B, connect to the WireGuard tunnels in AWS using UDP port 51820 via GRE and BGP. The AWS appliances, aws-gw-a and aws-gw-b, communicate with each other using GRE and BGP as well.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
