Selecting Subnets for a Service in AWS Fargate

First Question - Security

Security groups are a firewall that runs on the instance hypervisor. Network ACLs are a firewall that runs on the network. You can use either, or both. In theory a NACL reduces host load, but it's likely negligable.

Security groups are stateful, so return traffic is automatically allowed. NACLs require firewall rules for each direction to be specified, including ephemeral ports. Security groups are therefore easier to use.

In your case I suggest you add a security group rule that allows access from your /32 IP for every protocol you require. The IP goes into the rightmost column.

Second Question - VPN

OpenVPN doesn't change the IP address of anything, it can be thought of as a gateway. Your computer connects to the EC2 instance, when then has any access that the EC2 instance has. If we know what you were trying to achieve with a VPN we may be able to give better advice.

Given your updated requirements, I would probably use an EC2 server in a public subnet as a VPN terminator and NAT instance, and a private instance EC2 in a private subnet. Your NACLs and security groups would be set up to allow outgoing internet access via the NAT but deny incoming connections other than from the VPN instance.

I'm not sure if a single instance can be VPN terminator and NAT. I suspect it can.

There are many reasons. Here are a few, but there are many more cases.

SECURITY:

By launching instances in private subnets, they cannot be accessed from the public Internet. These instances can be accessed by other means such as thru load balancers.

STABILITY:

You may want locked down instances that do not change, meaning no patches, no software updates, etc. I use this case all the time. When we want to update an instance, we actually deploy new AMIs and do not update the instances. We test the new AMIs with all new patches before deployment.

HYBRID ENVIRONMENTS:

In this case, the private subnets only have a VGW (Virtual Private Gateway) which allows access from the private data center to access the instances in the private subnet. Active Directory instances would be an example of this.

Note: Just because an instance is located in a private subnet, this does not mean that at certain desired points of time the instances cannot access the Internet. By adding a NAT Gateway, NAT Instance, etc for a period of time will allow Internet access (from the instance to the Internet).