en-US - - English

PassMan AWS Cloud Site-to-Site VPN


Preparations

  • Sign in to the AWS Management Console.
  • Prepare a CentOS 7 server (VM) to install the Openswan VPN software on (for high availability, 2 servers).

Steps

  1. Creating the customer gateway
  2. Creating the virtual private gateway
  3. Creating the S2S VPN connection
  4. Changing the routing table of the private subnet
  5. Changing the security group of the PassMan instance
  6. Installing the Openswan VPN software
  7. Checking the VPN tunnel in the AWS Management Console
  8. Testing
  9. Setting up routing

1. Creating the customer gateway

This gateway defines the on-premises side of the S2S VPN in AWS. Choose the Customer Gateways section, and create a new gateway: Create Customer gateway. In the Details window, enter the name of the customer gateway (for example, <CUSTOMER>-CGW), then give the public IP address of the on-premises network. Save the setting with the orange button below.

2. Creating the virtual private gateway

This gateway describes the AWS side of the S2S VPN. Choose the Virtual Private Gateway section on the left. Give a name (for example, <VPC>-VPGW), then Create Private Gateway.

Then select the new virtual private gateway, and attach it to the PassMan VPC with Actions > Attach to VPC. Choose the VPC of PassMan Cloud, then select Attach to VPC. Wait until the gateway is in the Attached state (about 10 seconds).

3. Creating the site-to-site VPN connection

To create the VPN, under Site-to-Site VPN Connections, select Create VPN connection. Give the name of the VPN connection, and choose the virtual private gateway and the customer gateway created before. Under Routing options, choose Static, and enter the internal CIDR range of the on-premises network.

When you are done, select Create VPN connection at the bottom. After the State changes from Pending to Available (2-3 minutes), select the VPN connection and download its configuration with Download configuration. In the window that opens, choose the VPN solution you want to use (Vendor). This description focuses on Openswan.

4. Changing the AWS routing table

For correct routing between the PassMan VPC and the on-premises network, you must change the routing table of the private subnet of the PassMan VPC. Make sure you set it on the routing table of the private subnet. In the Route Tables menu, choose the route table of the PassMan Cloud private subnet, and go to the Route propagation tab. Select Edit route propagation, and enable propagation. Finally: Save.

5. Changing the PassMan security group

For testing from the on-premises network, it is worth allowing ICMP packets on the AWS side, in the security group of PassMan. Save with Save rules.

6. Installing Openswan on the on-premises network

In this example, the Openswan VPN software was installed on a CentOS 7 VM in the on-premises network. Open the VPN configuration description you downloaded earlier (for example, vpn-<id>.txt), and follow it.

Installing Openswan

# sudo su -
# yum install openswan -y

Setting up port forwarding

# vi /etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

# service network restart
# sysctl -p

Creating the IPsec configuration file

# vi /etc/ipsec.d/aws.conf
conn Tunnel1
    authby=secret
    auto=start
    left=%defaultroute
    leftid=<corporate public IP>     # CORPORATE PUBLIC
    right=<AWS tunnel public IP>     # AWS PUBLIC
    type=tunnel
    ikelifetime=8h
    keylife=1h
    phase2alg=aes128-sha1;modp1024
    ike=aes128-sha1;modp1024
    keyingtries=%forever
    keyexchange=ike
    leftsubnet=<on-premises CIDR>    # CORPORATE SIDE
    rightsubnet=<AWS VPC CIDR>       # AWS SIDE
    dpddelay=10
    dpdtimeout=30
    dpdaction=restart_by_peer

Make sure to delete the auth=esp line from the configuration file; otherwise the ipsec service does not start. You do not need to change the leftid and right values from the configuration description, only the leftsubnet and rightsubnet values.

Creating the AWS VPN secrets file

(based on the configuration description)

# vi /etc/ipsec.d/aws.secrets
<corporate public IP> <AWS tunnel public IP>: PSK "<pre-shared key from the configuration description>"

Enabling and starting the IPsec service

# systemctl enable ipsec
# systemctl start ipsec

Checking the IPsec service

# systemctl status ipsec

If the connection succeeds, the service log contains entries like these:

pluto[...]: loading secrets from "/etc/ipsec.d/aws.secrets"
pluto[...]: "Tunnel1" #1: initiating Main Mode
pluto[...]: "Tunnel1" #1: STATE_MAIN_I4: ISAKMP SA established {auth=PRESHARED_KEY cipher=aes_128 integ=sha group=MODP1024}
pluto[...]: "Tunnel1" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode

7. Checking the VPN tunnel in the AWS Management Console

In AWS, under Site-to-Site VPN Connections, select the VPN connection, and check on the Tunnel details tab that the VPN connection is established. If everything is set up correctly, the VPN tunnel changes to the Up state within a few minutes.

8. Testing

For a basic test, ping the private IP address of one of the PassMan instances in the AWS network from the on-premises network:

# ping <PassMan instance private IP>
64 bytes from <PassMan instance private IP>: icmp_seq=1 ttl=64 time=17.7 ms
2 packets transmitted, 2 received, 0% packet loss

9. Setting up routing

If you cannot connect from PassMan Cloud to other targets inside the on-premises system, go through the IPTables firewall rules on the Openswan server, and make the necessary changes.