AWS Virtual Private Gateways and VPN Connections

bogotobogo.com site search:

VPN Install

In this article, we'll deal with two regions: Region-1 and Region-2.

VPN will be installed in Region-1. As usual, before we install any packages, we need to update Ubuntu's repository lists:

$ sudo apt-get update

Virtual private gateways

We want to use an optional Amazon VPC VPN connection that links our network to Amazon VPC virtual private cloud (VPC). A customer gateway is the anchor on the outer side of that connection. It can be a physical or software appliance. The anchor on the AWS side of the VPN connection is called a virtual private gateway.

To setup VPN, we need to have Customer Gateway which requires Virtual Private Gateway since as shown in the following diagram, the customer gateway, the VPN connection goes to the virtual private gateway, and the VPC.

Picture source: Your Customer Gateway

Navigate to the VPC-2 dashboard in Region-2. Click on Virtual Private Gateways and then Create Virtual Private Gateway.

Select the virtual private gateway that we've just created and select Attach to VPC-2.

Customer gateways

Click on Customer Gateways, and then Create Customer Gateway. In the dialogue that opens, enter the public IP address of our OpenVPN Access Server instance, with Routing set to the default value of Static.

Adding virtual gateways to route table

Click on Route Tables in VPC Management Console and select the routing table corresponding to our subnet(s).

Click on the Route Propagation tab and select the vgw identifier for the virtual private gateway that we created earlier, then click the Save button.

VPN connections

Click on the VPN Connections link at the bottom of the left frame:

Click on Create VPN Connection, and in the dialogue, select the virtual private gateway (vgw) and the customer gateway that we just created. Select Static Routing, and then enter the EIP of Open VPN Access VPN server.

Initially, got failure notice:

After resetting Static Route:

After the VPN connection has been created, the State of the connection should switch to available. As the connections have not been made yet to the VPN servers, it is perfectly normal for the icons to be red. Select the VPN connection that was created, and then note the Tunnel 1 and Tunnel 2 IP addresses below.

Click the Download Configuration button when finished.

In the Download Configuration dialog, select Generic as a vendor and then click the Yes, Download button.

A text file should be generated that contains our pre-shared keys (PSKs).

Inside the generated file, note the two Pre-Shared Keys that are under the IPsec Tunnel #1 and IPsec Tunnel #2 sections. These PSKs correspond to the password we will be using to access the VPN connection for Tunnel 1 and 2, respectively.

OpenVPN Access Server

Now, SSH into our OpenVPN Access Server on-premise instance and open the /etc/ipsec.conf file with a text editor. Once opened, change the rightsubnet= to the VPC CIDR mask. (consult the our VPCs section of the VPC Management Console). Under the VPC-CUST-GW1 and VPC-CUST-GW2 sections respectively, change the right= IPs to the Tunnel 1 and 2 IPs you we noted above. In our case, the proper configuration would look like the following: