I run several applications partly on AWS and partly on three home servers. To keep costs manageable, I'm considering hosting the frontend, domain, and possibly routing or entry-point services in AWS while keeping the backend and database on-premises. My home servers are behind NAT, and I'd like API traffic and long-lived WebSocket connections to go directly between clients and the home infrastructure instead of being routed through AWS and generating additional network charges. Ideally, AWS would serve the static frontend and help establish or direct the connection, while the client maintains a session with the on-prem backend. Is this architecture practical? What services, tunnel technology, and overall design would you recommend, and what reliability or security issues should I plan for?
5 Answers
If the goal is simply to serve a fast frontend, use a CDN for the static assets and keep the backend wherever it makes the most operational sense. Trying to have AWS tell the browser to “hand off” directly to a NATed home server won’t work reliably without a publicly reachable endpoint or an outbound tunnel. A site-to-site VPN is useful for private AWS-to-home communication, but it doesn’t by itself solve direct public access from clients.
You may not need AWS for much of this. Cloudflare can provide DNS, CDN delivery for the frontend, TLS, and a tunnel back to your home servers. That keeps the setup relatively simple and avoids routing application traffic through an AWS load balancer. Just make sure your chosen tunnel and proxy support WebSockets and configure reconnect behavior.
The architecture is technically possible, but the biggest risks are probably reliability rather than compute cost. Residential internet, power outages, changing IP addresses, and latency can all affect a public backend. WebSocket clients should be able to reconnect, and you’ll want monitoring, backups, authentication, rate limiting, and a recovery plan. For anything important, keeping at least a small fallback backend outside the house may be worth the expense.
Because the home servers are behind NAT and may have a changing residential IP, AWS cannot simply route inbound connections to them. The usual solution is an outbound tunnel from the home network, such as Cloudflare Tunnel, Tailscale, WireGuard, or a reverse proxy connected over a secure tunnel. The home side initiates the connection, so you don’t need to expose ports or depend on a fixed public IP.
A practical AWS-based design would be static frontend files behind a CDN, with DNS and TLS at the public edge, plus a secure WireGuard or Tailscale link from AWS to the home network. An AWS instance could run Nginx or another reverse proxy and forward requests over that link. However, this still puts the proxy and application traffic path in AWS, so it may not eliminate the network costs you’re trying to avoid.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures