Customer Gateway Configuration

Customer Gateway Configuration

ℹ️ Overview This is the most critical step - configuring Libreswan IPsec on EC2 Customer Gateway to establish VPN tunnels with AWS.

Download VPN Configuration

  1. Access VPC
    • Select Site-to-Site VPN Connection
    • Select the VPN Connection you created
    • Click Download Configuration

Create VPC

  1. In the Download Configuration dialog

    • Vendor: Select OpenSwan
    • Platform: Select OpenSwan
    • Software: Select OpenSwan 2.6.38+
    • IKE version: Select ikev1
    • Click Download

    💡 Note: Libreswan is the successor to OpenSwan, configurations are compatible

Create VPC

  1. Save the configuration file and connect via SSH to EC2 Customer Gateway

Create VPC Create VPC

Install and Configure Libreswan

  1. Install Libreswan (OpenSwan replacement)
sudo dnf install libreswan -y

💡 Libreswan: IPsec VPN implementation for Linux, successor to OpenSwan

Create VPC

  1. Check /etc/ipsec.conf (main configuration file)
sudo vi /etc/ipsec.conf
  • Verify default configuration
  • Press ESC and :q! to exit

Create VPC

  1. Configure IP forwarding in /etc/sysctl.conf
sudo vi /etc/sysctl.conf
  • Press i to edit, add at the end:
net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

⚠️ Important: IP forwarding is required for Customer Gateway to route traffic between VPN tunnel and local network

Create VPC

  • Press ESC and :wq! to save

Create VPC

  1. Apply sysctl configuration
sudo sysctl -p

Create VPC

Configure VPN Tunnels

  1. Create /etc/ipsec.d/aws.conf for 2 VPN tunnels
sudo vi /etc/ipsec.d/aws.conf
  • Press i to edit
  • Add configuration for 2 Tunnels (get info from downloaded VPN Configuration file)

🔑 Key Parameters:

  • leftid: Public IP of EC2 Customer Gateway
  • right: Public IP of AWS VPN Tunnel endpoint
  • leftsubnet: CIDR of VPN VPC (10.11.0.0/16)
  • rightsubnet: CIDR of AWS VPC (10.10.0.0/16)
  • overlapip=yes: Required because only 1 public IP
  • auto=start: Automatically start tunnel

💡 Important Notes:

  • Remove auth=esp line (not needed for Amazon Linux)
  • Change modp1024 to modp2048 (higher security)
  • Add config setup with uniqueids=no at file start
  • Change auto=route to auto=start

Create VPC Create VPC

  • Review configuration carefully

Create VPC

  • Press ESC and :wq! to save
  1. Reference the downloaded AWS configuration file

Create VPC

Configure Pre-Shared Keys

  1. Create /etc/ipsec.d/aws.secrets for authentication
sudo touch /etc/ipsec.d/aws.secrets

Create VPC

  1. Edit secrets file
sudo vi /etc/ipsec.d/aws.secrets
  • Press i to edit
  • Add Pre-Shared Keys for both tunnels (from VPN Configuration file - Step 5 of each tunnel)

🔐 Format:

<Customer Gateway Public IP> <AWS VPN Endpoint IP>: PSK "<pre-shared-key>"

Create VPC Create VPC Create VPC

  • Press ESC and :wq! to save

  • Verify file:

sudo cat /etc/ipsec.d/aws.secrets

Create VPC

Start VPN Tunnels

  1. Start and enable IPsec service
sudo systemctl restart systemd-networkd
sudo systemctl enable ipsec
sudo systemctl start ipsec
sudo systemctl status ipsec

✅ Expected Result: Service status = active (running)

Create VPC

  • If restart needed:
sudo systemctl restart systemd-networkd
sudo systemctl restart ipsec

Create VPC

💡 Check tunnel status:

sudo ipsec status
  • Should see at least 1 tunnel UP (ESTABLISHED)

Test VPN Connectivity

  1. Test ping from Customer Gateway to EC2 Private
ping <EC2-Private-IP> -c5

✅ Success: Receiving ping replies through VPN tunnel

Create VPC Create VPC

  1. Test ping from EC2 Private to Customer Gateway
ping <Customer-Gateway-Private-IP> -c5

✅ Success: Bidirectional VPN connectivity working!

Create VPC Create VPC

🏗️ Complete VPN Architecture

AWS VPC (10.10.0.0/16)
├── EC2 Private (10.10.4.x)
    ↓
Virtual Private Gateway
    ↓
VPN Tunnel (IPsec) - ESTABLISHED ✅
    ├── Tunnel 1: UP
    └── Tunnel 2: Standby
    ↓
Customer Gateway (Libreswan)
├── Public IP: x.x.x.x
└── Private IP: 10.11.1.x
    ↓
VPN VPC (10.11.0.0/16)

💡 Troubleshooting Tips:

  • Check Security Groups (ports 500, 4500 UDP)
  • View logs: sudo journalctl -u ipsec -f
  • Check status: sudo ipsec status
  • Verify routes: ip route show
  • If ping fails: sudo ip route add 10.10.4.0/24 dev ens5

🔒 Security Notes:

  • Pre-shared keys must be protected carefully
  • File permissions: chmod 600 /etc/ipsec.d/aws.secrets
  • Rotate keys periodically in production
  • Monitor tunnel status with CloudWatch

✅ Completed: VPN Site-to-Site is successfully configured and operational!