What I am trying to do is set up a web application that is public facing but makes calls to a database that is on an internal network. I have been trying to set up an AWS VPC with a public subnet, private subnet, and hardware VPN access but I can't seem to get it to work.

Can someone help me understand what the process flow here should be? My understanding is that I need a public subnet to handle the website requests and then a private subnet to connect to the VPN but what I do not understand is how to send requests down the chain and get the response. Basically what I am asking is how can I query the database via VPN from that public website?

I've tried during rout forwarding but I can't successfully complete the process.

Does anyone have any advice on something I can read on this subject or an FAQ on setting something like this up? Is it even possible?

I'm out of my league here, this is not my area of expertise but I'm being asked to solve this problem. Any help would be appreciated.

Thanks