VPN Site-to-Site from Home Network to AWS

In this guide, we’ll walk you through the process of configuring a VPN Site-to-Site from your home network to AWS, enabling seamless and secure communication between the two environments.

Understanding VPN Site-to-Site

Before diving into the setup process, let’s briefly understand what a VPN Site-to-Site connection entails.

A VPN Site-to-Site connection establishes a secure, encrypted tunnel between two networks, allowing them to communicate as if they were directly connected. In our case, we’ll be connecting our home network to an AWS Virtual Private Cloud (VPC), effectively extending our network infrastructure to the cloud.

Prerequisites

Before proceeding, ensure you have the following prerequisites in place:

• An AWS account with appropriate permissions to create VPC resources.
• public IP (find public IP of home network at link )

Configure AWS

• Create VPC with a private subnet
• Create a EC2 and config inboud for SG
• Creating a virtual private gateway
• Setting route table
• Site to Site VPN settings and download vendor config file

Create a new VPC with a CIDR block that does not conflict with your home network.

IPv4 CIDR: 10.0.0.0/16
Subnet private :subnet-09ea90bc4428089cc / subnet-private-1a, 10.0.32.0/20

Create a new EC2 in subnet-private-1 for test if you have not

Private IP : 10.0.44.45

EC2 sercurity group inboud setting(allow ping test only)

Creating a virtual private gateway

Attach to the VPC that will be the Site to Site VPN connection destination.

Edit route table

In the route table of the private subnet connection destination VPN, configure routing for the local network segment with the virtual private gateway as the destination.

Site to Site VPN settings

IP address : Your public IP adress

Static IP prefixes : Local network segment(192.168.0.0/16)

VPN config download

Chose Vendor is Strongwan and IKE version is ikev2

Configure the following settings according to the downloaded file.

Configure Local network

• Stop firewall
• Kernel parameter setting
• strongswan installation
• strongswan settings
• strongswan start
• Verify Connectivity

My Ubuntu server IP : 192.168.0.120

VPN server setting

Stop firewall

Kernel parameter setting

sudo vi /etc/sysctl.conf

net.ipv4.ip_forward = 1 
net.ipv6.conf.all.forwarding = 1 
net.ipv4.conf.all.accept_redirects = 0 
net.ipv4.conf.all.send_redirects = 0

sudo sysctl -p

strongswan installation

Install with the following command.

sudo apt update
sudo apt install -y strongswan

strongswan settings (/etc/ipsec.conf)

Create a new file at /etc/ipsec.conf if doesn’t already exist, and then open it. Add the following under the ‘config setup’ section:

sudo vi /etc/ipsec.conf

	charondebug="all"
	uniqueids=yes
	strictcrlpolicy=no

Append the following configuration to the end of the file:

conn Tunnel1
	type=tunnel
	auto=start
	keyexchange=ikev2
	authby=psk
	leftid=<Global IP address of connection source>
	leftsubnet= <On-premises CIDR Range>
	right=<Connection destination global IP address/Tunnel 1>
	rightsubnet= <VPC CIDR range>
	aggressive=no
	ikelifetime=28800s
	lifetime=3600s
	margintime=270s
	rekey=yes
	rekeyfuzz=100%
	fragmentation=yes
	replay_window=1024
	dpddelay=30s
	dpdtimeout=120s
	dpdaction=restart
	ike=aes128-sha1-modp1024
	esp=aes128-sha1-modp1024
	keyingtries=%forever
conn Tunnel2
	type=tunnel
	auto=start
	keyexchange=ikev2
	authby=psk
	leftid=<Global IP address of connection source>
	leftsubnet= <On-premises CIDR Range>
	right=<Connection destination global IP address/Tunnel 2>
	rightsubnet= <VPC CIDR range>
	aggressive=no
	ikelifetime=28800s
	lifetime=3600s
	margintime=270s
	rekey=yes
	rekeyfuzz=100%
	fragmentation=yes
	replay_window=1024
	dpddelay=30s
	dpdtimeout=120s
	dpdaction=restart
	ike=aes128-sha1-modp1024
	esp=aes128-sha1-modp1024
	keyingtries=%forever

strongswan setting（/etc/ipsec.secrets）

Create a new file at /etc/ipsec.secrets if it doesn’t already exist, and append this line to the file. This value authenticates the tunnel endpoints:

sudo vi /etc/ipsec.secrets

strongswan start

sudo ipsec restart
sudo ipsec status

Verify Connectivity

ping IP of private EC2 from local Ubuntu server

ping 10.0.44.45

To test connect from EC2 private instance to local ubuntu server, you can install SSM-agent for EC2

Conclusion

By following these steps, you’ve successfully set up a VPN Site-to-Site connection from your home network to AWS, enabling secure communication between the two environments. This setup enhances security by encrypting traffic over the internet and facilitates seamless access to cloud resources from the comfort of your home network. Experiment with different configurations and explore additional AWS networking features to optimize performance and security based on your specific requirements.

Thank you for reading the DevopsRoles page!

AWS Networking, AWS VPC, VPN Configuration