I have an OpenVPN AC server on AWS EC2. I use this VPN to have access to my AWS VPC (Virtual Private Cloud) where I have a server that I need to be only accessed through this channel.
Everything works great, my client connects to the server and it gets all communications through the VPN.
The problem I have is that I don't want any of my EC2 instances to have access to the internet. They must NOT be able to access any webpage or web service other than the available services inside my VPC.
Your question is unclear. Do you want the servers to not have access to the internet at all, or only when the VPN is connected? I'm going to assume all the time.
The typical way to do this is to use subnets. Your public subnet has a single server which terminates the VPN connection, passing packets to wherever they need to go. There's an internet gateway in this subnet. All other services are in your private subnet, and they have no route to the internet gateway. This is a very standard setup, so standard the VPC wizard can set it up for you.
You could potentially make one server a VPN based bastion and an outgoing NAT, if required.
