{"id":97,"date":"2023-11-05T23:04:57","date_gmt":"2023-11-05T21:04:57","guid":{"rendered":"https:\/\/blog.twis7.com\/?p=97"},"modified":"2023-11-05T23:44:41","modified_gmt":"2023-11-05T21:44:41","slug":"site-to-site-ipsec-vpn-with-strongswan-and-aws","status":"publish","type":"post","link":"https:\/\/blog.twis7.com\/index.php\/2023\/11\/05\/site-to-site-ipsec-vpn-with-strongswan-and-aws\/","title":{"rendered":"Site to Site ipsec VPN with Strongswan and AWS"},"content":{"rendered":"\n

The purpose of this article is to explain how to create site to site VPN<\/strong> from a Linux machine to the AWS cloud. I will use Strongswan<\/a> installed on Ubuntu 20.04 in the Scaleway<\/a> cloud and AWS VPC. Scaleway offers (at least for now<\/a>) VPS with Private Subnet and Public IP connected via NAT. In the AWS cloud, I already created VPC with one public and one private subnet – If you do not know how to do it, Neal Davis explains in this video<\/a>.
In the end, we will have ipsec tunnel, connecting our Linux server with the resources of AWS, placed in a private subnet.<\/p>\n\n\n\n\n\n\n\n

<\/circle><\/circle><\/circle><\/g><\/svg><\/span><\/path><\/path><\/svg><\/span>
AWS<\/span> side<\/span>:<\/span><\/span>\nPublic<\/span> <\/span>Gateway<\/span> <\/span>for<\/span> <\/span>Tunnel<\/span> <\/span>1<\/span>: <\/span>34.202<\/span>.<\/span>11.224<\/span><\/span>\nPublic<\/span> <\/span>Gateway<\/span> <\/span>for<\/span> <\/span>Tunnel<\/span> <\/span>2<\/span>: <\/span>34.202<\/span>.<\/span>210.66<\/span><\/span>\nPrivate<\/span> Subnet<\/span>:<\/span> <\/span>172.29<\/span>.<\/span>3.0<\/span>\/<\/span>24<\/span><\/span>\n<\/span>\nScaleway<\/span> (<\/span>ubuntu<\/span>) side<\/span>:<\/span><\/span>\nPublic<\/span> Gateway <\/span>:<\/span> <\/span>51.158<\/span>.<\/span>69.180<\/span><\/span>\nPrivate<\/span> Subnet<\/span>:<\/span> <\/span>10.70<\/span>.<\/span>126.243<\/span>\/<\/span>31<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
AWS <\/h3>\n\n\n\n
it’s important to start with AWS first, because in that way we’ll get all the necessary IPs we need later.
Go to VPC -> expand Virtual private network (VPN) -> Virtual private gateways<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Choose a name and click Create virtual private gateway<\/em><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Attach the private gateway to the VPC<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
In order to route the traffic from the virtual private gateway to the private subnet, we should use Route propagation. 
Click on VPC -> Route Tables -> your private route table -> route propagation -> your virtual gateway<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Tick enable and save<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Create customer gateway, click Customer Gateways -> Create customer gateway<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
It is time to create site-to-site VPN<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
on the same page, choose this options.
Pre-shared key for tunnel is the password (make it strong!)
Phase 1 DH Group Numbers : 24
Phase 1 DH Group Numbers : 24
Phase 1 lifetime (seconds): 28800
Phase 2 lifetime (seconds): 3600
DPD timeout (seconds): 30
Replay window size (packets): 1024
Rekey fuzz (percentage): 100
Rekey margin time (seconds): 270
DPD timeout action: Restart
Startup action<\/a> : add
And the others like the picture below
For Tunnel 2 choose the same as Tunnel 1<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
After the VPN is ready, click on static routes -> edit routes<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
type the ubuntu private subnet or ubuntu private IP<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
The AWS side is ready, lets start with<\/p>\n\n\n\n
Ubuntu Strongswan<\/h3>\n\n\n\n
Enable Kernel Packet Forwarding 
edit \/etc\/sysctl.conf<\/strong><\/em> 
Find the following options and uncomment them and set their values to:<\/p>\n\n\n\n
<\/circle><\/circle><\/circle><\/g><\/svg><\/span><\/path><\/path><\/svg><\/span>
net<\/span>.<\/span>ipv4<\/span>.<\/span>ip_forward<\/span> <\/span>=<\/span> <\/span>1<\/span> <\/span><\/span>\nnet<\/span>.<\/span>ipv4<\/span>.<\/span>conf<\/span>.<\/span>all<\/span>.<\/span>accept_redirects<\/span> <\/span>=<\/span> <\/span>0<\/span> <\/span><\/span>\nnet<\/span>.<\/span>ipv4<\/span>.<\/span>conf<\/span>.<\/span>all<\/span>.<\/span>send_redirects<\/span> <\/span>=<\/span> <\/span>0<\/span> <\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
Save the settings to the kernel<\/p>\n\n\n\n
<\/circle><\/circle><\/circle><\/g><\/svg><\/span><\/path><\/path><\/svg><\/span>
sudo<\/span> <\/span>sysctl<\/span> <\/span>-<\/span>p<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
Install Strongswan<\/p>\n\n\n\n
<\/circle><\/circle><\/circle><\/g><\/svg><\/span><\/path><\/path><\/svg><\/span>
$<\/span> <\/span>sudo<\/span> <\/span>apt<\/span> <\/span>update<\/span><\/span>\n$<\/span> <\/span>sudo<\/span> <\/span>apt<\/span> <\/span>install<\/span> <\/span>strongswan<\/span> <\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
edit \/etc\/ipsec.conf <\/strong><\/em>as show and replace with your IPs
To understand the lines above, read the documentation<\/a><\/p>\n\n\n\n
<\/circle><\/circle><\/circle><\/g><\/svg><\/span><\/path><\/path><\/svg><\/span>
# <\/span>ipsec<\/span>.<\/span>conf<\/span> <\/span>-<\/span> <\/span>strongSwan<\/span> <\/span>IPsec<\/span> <\/span>configuration<\/span> <\/span>file<\/span><\/span>\n<\/span>\n# <\/span>basic<\/span> <\/span>configuration<\/span><\/span>\n##### <\/span>Tunel<\/span> <\/span>1<\/span><\/span>\nconfig<\/span> <\/span>setup<\/span><\/span>\n         <\/span>strictcrlpolicy<\/span>=<\/span>no<\/span><\/span>\n         <\/span>uniqueids<\/span> <\/span>=<\/span> <\/span>yes<\/span><\/span>\nconn<\/span> <\/span>ubuntu_to_aws1<\/span><\/span>\n       <\/span>type<\/span>=<\/span>tunnel<\/span><\/span>\n       <\/span>auto<\/span>=<\/span>route<\/span><\/span>\n       <\/span>keyexchange<\/span>=<\/span>ikev2<\/span><\/span>\n       <\/span>leftauth<\/span>=<\/span>psk<\/span><\/span>\n       <\/span>authby<\/span>=<\/span>secret<\/span><\/span>\n       <\/span>left<\/span>=<\/span>10.70<\/span>.<\/span>126.243<\/span><\/span>\n       <\/span>leftsubnet<\/span>=<\/span>10.70<\/span>.<\/span>126.243<\/span>\/<\/span>31<\/span><\/span>\n       <\/span>leftid<\/span>=<\/span>51.158<\/span>.<\/span>69.180<\/span><\/span>\n       <\/span>right<\/span>=<\/span>34.202<\/span>.<\/span>11.224<\/span><\/span>\n       <\/span>rightsubnet<\/span>=<\/span>172.29<\/span>.<\/span>3.0<\/span>\/<\/span>24<\/span><\/span>\n       <\/span>rightid<\/span>=<\/span>34.202<\/span>.<\/span>11.224<\/span><\/span>\n       <\/span>ike<\/span>=<\/span>aes256<\/span>-<\/span>sha512<\/span>-<\/span>modp2048s256<\/span><\/span>\n       <\/span>esp<\/span>=<\/span>aes256<\/span>-<\/span>sha512<\/span>-<\/span>modp2048s256<\/span><\/span>\n       <\/span>rightauth<\/span>=<\/span>psk<\/span><\/span>\n       <\/span>keyingtries<\/span>=%<\/span>forever<\/span><\/span>\n       <\/span>ikelifetime<\/span>=<\/span>28800<\/span>s<\/span><\/span>\n       <\/span>lifetime<\/span>=<\/span>3600<\/span>s<\/span><\/span>\n       <\/span>dpddelay<\/span>=<\/span>30<\/span>s<\/span><\/span>\n       <\/span>dpdtimeout<\/span>=<\/span>120<\/span>s<\/span><\/span>\n       <\/span>dpdaction<\/span>=<\/span>restart<\/span><\/span>\n       <\/span><\/span>\n     #<\/span>Tunnel<\/span> <\/span>2<\/span><\/span>\n     <\/span>conn<\/span> <\/span>ubuntu_to_aws2<\/span><\/span>\n       <\/span>type<\/span>=<\/span>tunnel<\/span><\/span>\n       <\/span>auto<\/span>=<\/span>route<\/span><\/span>\n       <\/span>keyexchange<\/span>=<\/span>ikev2<\/span><\/span>\n       <\/span>leftauth<\/span>=<\/span>psk<\/span><\/span>\n       <\/span>authby<\/span>=<\/span>secret<\/span><\/span>\n       <\/span>left<\/span>=<\/span>10.70<\/span>.<\/span>126.243<\/span><\/span>\n       <\/span>leftsubnet<\/span>=<\/span>10.70<\/span>.<\/span>126.243<\/span>\/<\/span>31<\/span><\/span>\n       <\/span>leftid<\/span>=<\/span>51.158<\/span>.<\/span>69.180<\/span><\/span>\n       <\/span>right<\/span>=<\/span>34.202<\/span>.<\/span>210.66<\/span><\/span>\n       <\/span>rightsubnet<\/span>=<\/span>172.29<\/span>.<\/span>3.0<\/span>\/<\/span>24<\/span><\/span>\n       <\/span>rightid<\/span>=<\/span>34.202<\/span>.<\/span>210.66<\/span><\/span>\n       <\/span>ike<\/span>=<\/span>aes256<\/span>-<\/span>sha512<\/span>-<\/span>modp2048s256<\/span><\/span>\n       <\/span>esp<\/span>=<\/span>aes256<\/span>-<\/span>sha512<\/span>-<\/span>modp2048s256<\/span><\/span>\n       <\/span>rightauth<\/span>=<\/span>psk<\/span><\/span>\n       <\/span>keyingtries<\/span>=%<\/span>forever<\/span><\/span>\n       <\/span>ikelifetime<\/span>=<\/span>28800<\/span>s<\/span><\/span>\n       <\/span>lifetime<\/span>=<\/span>3600<\/span>s<\/span><\/span>\n       <\/span>dpddelay<\/span>=<\/span>30<\/span>s<\/span><\/span>\n       <\/span>dpdtimeout<\/span>=<\/span>120<\/span>s<\/span><\/span>\n       <\/span>dpdaction<\/span>=<\/span>restart<\/span><\/span>\n<\/span>\n<\/span><\/code><\/pre><\/div>\n\n\n\n
edit \/etc\/ipsec.secrets with your IPs and password<\/p>\n\n\n\n
<\/circle><\/circle><\/circle><\/g><\/svg><\/span><\/path><\/path><\/svg><\/span>
# <\/span>This<\/span> <\/span>file<\/span> <\/span>holds<\/span> <\/span>shared<\/span> <\/span>secrets<\/span> <\/span>or<\/span> <\/span>RSA<\/span> <\/span>private<\/span> <\/span>keys<\/span> <\/span>for<\/span> <\/span>authentication<\/span>.<\/span><\/span>\n<\/span>\n# <\/span>RSA<\/span> <\/span>private<\/span> <\/span>key<\/span> <\/span>for<\/span> <\/span>this<\/span> <\/span>host<\/span>,<\/span> <\/span>authenticating<\/span> <\/span>it<\/span> <\/span>to<\/span> <\/span>any<\/span> <\/span>other<\/span> <\/span>host<\/span><\/span>\n# <\/span>which<\/span> <\/span>knows<\/span> <\/span>the<\/span> <\/span>public<\/span> <\/span>part<\/span>.<\/span><\/span>\n10.70<\/span>.<\/span>126.243<\/span> <\/span>34.202<\/span>.<\/span>11.224<\/span> : <\/span>PSK<\/span> <\/span>"<\/span>SuperStrongPassKey9<\/span>"<\/span><\/span>\n<\/span>\n10.70<\/span>.<\/span>126.243<\/span> <\/span>34.202<\/span>.<\/span>210.66<\/span> : <\/span>PSK<\/span> <\/span>"<\/span>SuperStrongPassKey9<\/span>"<\/span><\/span>\n<\/span><\/code><\/pre><\/div>\n\n\n\n
Reload the configuration and restart the service with<\/p>\n\n\n\n
<\/circle><\/circle><\/circle><\/g><\/svg><\/span><\/path><\/path><\/svg><\/span>
sudo<\/span> <\/span>ipsec<\/span> <\/span>reload<\/span><\/span>\nsudo<\/span> <\/span>ipsec<\/span> <\/span>restart<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
Start the tunnel with<\/p>\n\n\n\n
<\/circle><\/circle><\/circle><\/g><\/svg><\/span><\/path><\/path><\/svg><\/span>
sudo<\/span> <\/span>ipsec<\/span> <\/span>up<\/span> <\/span>ubuntu_to_aws1<\/span> <\/span><\/span>\nsudo<\/span> <\/span>ipsec<\/span> <\/span>up<\/span> <\/span>ubuntu_to_aws2<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n
If everything is ok, you should see something like this<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
I started an ec2 linux machine in the private subnet to test the tunnel connection and it works!!!<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
If it do not works check your firewall or NAT settings. Look at strongswan logs in \/var\/logs\/syslog
You can enable AWS site-to-site logs and check the in cloudwatch too.<\/p>\n","protected":false},"excerpt":{"rendered":"
The purpose of this article is to explain how to create site to site VPN from a Linux machine to the AWS cloud. I will use Strongswan installed on Ubuntu 20.04 in the Scaleway cloud and AWS VPC. Scaleway offers (at least for now) VPS with Private Subnet and Public IP connected via NAT. In… Continue reading Site to Site ipsec VPN with Strongswan and AWS<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,3,17],"tags":[],"class_list":["post-97","post","type-post","status-publish","format-standard","hentry","category-aws","category-ubuntu","category-vpn"],"_links":{"self":[{"href":"https:\/\/blog.twis7.com\/index.php\/wp-json\/wp\/v2\/posts\/97","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.twis7.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.twis7.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.twis7.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.twis7.com\/index.php\/wp-json\/wp\/v2\/comments?post=97"}],"version-history":[{"count":16,"href":"https:\/\/blog.twis7.com\/index.php\/wp-json\/wp\/v2\/posts\/97\/revisions"}],"predecessor-version":[{"id":128,"href":"https:\/\/blog.twis7.com\/index.php\/wp-json\/wp\/v2\/posts\/97\/revisions\/128"}],"wp:attachment":[{"href":"https:\/\/blog.twis7.com\/index.php\/wp-json\/wp\/v2\/media?parent=97"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.twis7.com\/index.php\/wp-json\/wp\/v2\/categories?post=97"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.twis7.com\/index.php\/wp-json\/wp\/v2\/tags?post=97"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}