In terms of a vpn nic (or a more advanced firewall router device that handles VPN) that would only help, I think, if you could mirror that setup at the ec2 side, somehow... don't know enough about ec2 options to comment there?