Scenario 3 – VPC with public and private subnets and hardware VPN access