AWS側は、マネージドVPNサービスのSite to Site VPNを使う。
オンプレミス側は、ソフトウェアルータのvyosのvpnサービスを使う。
AWS側の構築
適当なvpcを作り、カスタマーゲートウェイ、仮装プライベートゲートウェイ、Site to Site VPNを作る。
カスタマーゲートウェイを作る。
IPアドレスは、オンプレミス側のグローバルIPを指定する。
ポートの穴あけができない場合、NATされている場合でも同じように指定する。
仮装プライベートゲートウェイを作る。
AWS側のASNとなり、基本的にデフォルトで良い。
用意したいASNがAWS側と被るのであれば変える必要があるはず。
Site To Site VPNを作る。
上記で作成したカスタマーゲートウェイと仮装プライベートゲートウェイを指定するのみで良い。
vyosではBGPを扱うことができるため、せっかくなのでBGPを使いたいので、有効にしておく。
このような形で作られる。
オンプレミス側の構築
構築するvyosは2つNICかあり、eth0はNATルータと同じネットワーク、eth1はvyosからのみ接続されているプライベートネットワークの想定。
大きく2つのフローがあり、まずはipsecvpnトンネリングの確立が必要。その後にbgpの設定を入れていく。
慣れていればいいのだけど、一緒にやると切り分けが面倒くさいので、1つづつやっていく。
ちなみに、本来であれば、冗長性を持たすために2系統のトンネリング接続を設定することが推奨されているが、検証なので1系統のみやる。2系統やる時は必要な設定を単純に置き換えれば接続はできるはず。
基本設定
|
1 2 3 4 |
set interfaces ethernet eth0 address 192.168.50.106/24 set interfaces ethernet eth1 address 172.16.2.1/24 set protocols static route 0.0.0.0/0 next-hop 192.168.50.1 set service ssh |
AWS側でルータ側に設定するConfigサンプルをダウンロードできるので、それをvyos用コマンドに変換していく。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 |
set interfaces vti vti0 address '169.254.177.182/30' set interfaces vti vti0 description 'VPC tunnel 1' set interfaces vti vti0 mtu '1436' # set vpn ipsec esp-group AWS compression set vpn ipsec esp-group AWS lifetime '3600' set vpn ipsec esp-group AWS mode 'tunnel' set vpn ipsec esp-group AWS pfs 'enable' set vpn ipsec esp-group AWS proposal 1 encryption 'aes128' set vpn ipsec esp-group AWS proposal 1 hash 'sha1' set vpn ipsec ike-group AWS dead-peer-detection action 'restart' set vpn ipsec ike-group AWS dead-peer-detection interval '15' set vpn ipsec ike-group AWS dead-peer-detection timeout '30' set vpn ipsec ike-group AWS lifetime '28800' set vpn ipsec ike-group AWS proposal 1 dh-group '2' set vpn ipsec ike-group AWS proposal 1 encryption 'aes128' set vpn ipsec ike-group AWS proposal 1 hash 'sha1' # インターネットに接続しているルータがNATしている場合はこちらの設定を入れる ここから---- set vpn ipsec site-to-site peer 13-230-113-189 authentication local-id 122.131.251.26 set vpn ipsec site-to-site peer 13-230-113-189 authentication remote-id 13.230.113.189 set vpn ipsec site-to-site peer 13-230-113-189 local-address 192.168.50.106 # ここまで---- set vpn ipsec site-to-site peer 13-230-113-189 remote-address 13.230.113.189 set vpn ipsec site-to-site peer 13-230-113-189 authentication mode 'pre-shared-secret' set vpn ipsec authentication psk vyos id 13.230.113.189 set vpn ipsec authentication psk vyos secret '1hNvlDTZTXqfDh5PUaVSL7BrTshHk.Q3' set vpn ipsec site-to-site peer 13-230-113-189 description 'VPC tunnel 1' set vpn ipsec site-to-site peer 13-230-113-189 ike-group 'AWS' set vpn ipsec site-to-site peer 13-230-113-189 vti bind 'vti0' set vpn ipsec site-to-site peer 13-230-113-189 vti esp-group 'AWS' # commitしたときに警告が出る set vpn ipsec option disable-route-autoinstall commit save exit # デバッグする時 show log vpn |
接続状態を確認する。
接続成功していれば、それぞれstateがupとなっているはず。
|
1 2 3 4 5 6 7 8 |
vyos@vyos:~$ show vpn ike sa Peer ID / IP Local ID / IP ------------ ------------- 13.230.113.189 13.230.113.189 192.168.50.106 192.168.50.106 State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time ----- ------ ------- ---- --------- ----- ------ ------ up IKEv2 AES_CBC_128 HMAC_SHA1_96 MODP_1024 yes 167 28031 |
|
1 2 3 4 |
vyos@vyos:~$ show vpn ipsec sa Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal ------------------ ------- -------- -------------- ---------------- ---------------- -------------- ------------------------ 13-230-113-189-vti up 3m9s 120B/80B 2/2 13.230.113.189 13.230.113.189 AES_CBC_128/HMAC_SHA1_96 |
また、AWS側の状態もステータスが「アップ」となる。
AWS側のVPNの内部IPへの接続性を確認する。ネットワークアドレスが、169.254.177.180/30なので、169.254.177.181と169.254.177.182の2つしかない。
ダウンロードしたConfigを見ると、このようになっているので、181がVPN側、182がオンプレミス側。ということになる。
|
1 2 3 |
Inside IP Addresses - Customer Gateway : 169.254.177.182/30 - Virtual Private Gateway : 169.254.177.181/30 |
|
1 2 3 4 5 6 7 8 9 |
vyos@vyos:~$ ping 169.254.177.181 count 3 PING 169.254.177.181 (169.254.177.181) 56(84) bytes of data. 64 bytes from 169.254.177.181: icmp_seq=1 ttl=254 time=5.29 ms 64 bytes from 169.254.177.181: icmp_seq=2 ttl=254 time=5.54 ms 64 bytes from 169.254.177.181: icmp_seq=3 ttl=254 time=5.35 ms --- 169.254.177.181 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2004ms rtt min/avg/max/mdev = 5.286/5.391/5.544/0.110 ms |
続いて、bgpの設定をする。
AWS側で仮想プライベートゲートウェイへのルート伝播を有効にしておく。
一般的には、経路宣伝という言葉が、AWSだとルート伝播という言葉のよう。
これを設定することで、対抗のルータがBGPに対応していれば、ルーティングを渡すことできる。（厳密にはコピーしているはず）
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
# vyos側 set protocols bgp system-as 65000 set protocols bgp neighbor 169.254.177.181 remote-as '64512' set protocols bgp neighbor 169.254.177.181 address-family ipv4-unicast soft-reconfiguration inbound set protocols bgp neighbor 169.254.177.181 update-source '192.168.50.106' set protocols bgp timers holdtime '30' set protocols bgp timers keepalive '10' # 経路宣伝 set protocols bgp address-family ipv4-unicast network 192.168.50.0/24 set protocols bgp address-family ipv4-unicast network 172.16.2.0/24 # 保存 commit save exit restart all |
設定後、bgp設定が反映されているか確認する。
|
1 2 3 4 5 6 7 8 9 10 11 12 |
vyos@vyos:~$ show ip bgp summary IPv4 Unicast Summary (VRF default): BGP router identifier 192.168.50.106, local AS number 65000 vrf-id 0 BGP table version 2 RIB entries 3, using 288 bytes of memory Peers 1, using 20 KiB of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt Desc 169.254.177.181 4 64512 12447 12447 2 0 0 1d10h33m 1 2 N/A Total number of neighbors 1 |
オンプレミス側から見たネイバー169.254.177.181の設定。つまるところ、VPN側の設定を参照できる。
ルーティングテーブルを見てみると、オンプレミス側の192.168.50.0のルーティングが伝播していることがわかる。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
vyos@vyos:~$ show ip bgp neighbors 169.254.177.181 routes BGP table version is 2, local router ID is 192.168.50.106, vrf id 0 Default local pref 100, local AS 65000 Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, i internal, r RIB-failure, S Stale, R Removed Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found Network Next Hop Metric LocPrf Weight Path *> 10.0.0.0/16 169.254.177.181 100 0 64512 i Displayed 1 routes and 2 total paths |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
vyos@vyos:~$ show ip bgp neighbors 169.254.177.181 advertised-routes BGP table version is 2, local router ID is 192.168.50.106, vrf id 0 Default local pref 100, local AS 65000 Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, i internal, r RIB-failure, S Stale, R Removed Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found Network Next Hop Metric LocPrf Weight Path *> 10.0.0.0/16 0.0.0.0 0 64512 i *> 192.168.50.0/24 0.0.0.0 0 32768 i Total number of prefixes 2 |
vyos側のルートテーブルをみると、10.0.0.0/16のルーティングがBGPにより伝播していることがわかる。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
vyos@vyos:~$ show ip route Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, f - OpenFabric, > - selected route, * - FIB route, q - queued, r - rejected, b - backup t - trapped, o - offload failure S>* 0.0.0.0/0 [1/0] via 192.168.50.1, eth0, weight 1, 1d11h09m B>* 10.0.0.0/16 [20/100] via 169.254.177.181, vti0, weight 1, 1d11h00m C>* 169.254.177.180/30 is directly connected, vti0, 1d11h10m C>* 172.16.2.0/24 is directly connected, eth1, 1d11h10m C>* 192.168.50.0/24 is directly connected, eth0, 1d11h10m |
AWS側のルートテーブルを直接みると、このようになっている。
NATルータの場合は、ルータの設定も一応確認しておく。
確認したいポイントは、このルータの場合は、IPSecパススルーが有効になっているかどうか。
もうちょっと具体的な設定ができる場合は、ポート4500と500が、オンプレミス側のVPNルータのIP（今回の場合、192.168.50.106）へのNATトラバーサル設定が入っているかどうか。
動作確認
vpc内に、適当なEC2を作る。
vpnルータ配下の適当なマシンから、EC2にpingを送って接続できればOK。
ちなみに、vpnルータと化しているvyosからpingを送っても到達しなかった。
pingを送る際に、interfaceを指定できるのだけど、指定してもダメだった。
|
1 2 3 4 5 6 7 8 9 10 |
vyos@vyos:~$ ping 10.0.136.97 count 3 PING 10.0.136.97 (10.0.136.97) 56(84) bytes of data. 64 bytes from 10.0.136.97: icmp_seq=1 ttl=126 time=7.12 ms 64 bytes from 10.0.136.97: icmp_seq=2 ttl=126 time=6.80 ms 64 bytes from 10.0.136.97: icmp_seq=3 ttl=126 time=7.79 ms --- 10.0.136.97 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 6.798/7.235/7.790/0.413 ms vyos@vyos:~$ |
AWSからダウンロードしたConfig
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 |
Amazon Web Services Virtual Private Cloud VPN Connection Configuration ================================================================================ AWS utilizes unique identifiers to manipulate the configuration of a VPN Connection. Each VPN Connection is assigned a VPN Connection Identifier and is associated with two other identifiers, namely the Customer Gateway Identifier and the Virtual Private Gateway Identifier. Your VPN Connection ID : vpn-096306430f89c3174 Your Virtual Private Gateway ID : vgw-0d0fa8ffec8c277ac Your Customer Gateway ID : cgw-01b2ae9fa3c43a27b A VPN Connection consists of a pair of IPSec tunnel security associations (SAs). It is important that both tunnel security associations be configured. IPSec Tunnel #1 ================================================================================ #1: Internet Key Exchange Configuration Configure the IKE SA as follows: Please note, these sample configurations are for the minimum requirement of AES128, SHA1, and DH Group 2. Category "VPN" connections in the GovCloud region have a minimum requirement of AES128, SHA2, and DH Group 14. You will need to modify these sample configuration files to take advantage of AES256, SHA256, or other DH groups like 2, 14-18, 22, 23, and 24. NOTE: If you customized tunnel options when creating or modifying your VPN connection, you may need to modify these sample configurations to match the custom settings for your tunnels. Higher parameters are only available for VPNs of category "VPN," and not for "VPN-Classic". The address of the external interface for your customer gateway must be a static address. Your customer gateway may reside behind a device performing network address translation (NAT). To ensure that NAT traversal (NAT-T) can function, you must adjust your firewall !rules to unblock UDP port 4500. If not behind NAT, and you are not using an Accelerated VPN, we recommend disabling NAT-T. If you are using an Accelerated VPN, make sure that NAT-T is enabled. - IKE version : IKEv2 - Authentication Method : Pre-Shared Key - Pre-Shared Key : 1hNvlDTZTXqfDh5PUaVSL7BrTshHk.Q3 - Authentication Algorithm : sha1 - Encryption Algorithm : aes-128-cbc - Lifetime : 28800 seconds - Phase 1 Negotiation Mode : main - Diffie-Hellman : Group 2 #2: IPSec Configuration Configure the IPSec SA as follows: Category "VPN" connections in the GovCloud region have a minimum requirement of AES128, SHA2, and DH Group 14. Please note, you may use these additionally supported IPSec parameters for encryption like AES256 and other DH groups like 2, 5, 14-18, 22, 23, and 24. NOTE: If you customized tunnel options when creating or modifying your VPN connection, you may need to modify these sample configurations to match the custom settings for your tunnels. Higher parameters are only available for VPNs of category "VPN," and not for "VPN-Classic". - Protocol : esp - Authentication Algorithm : hmac-sha1-96 - Encryption Algorithm : aes-128-cbc - Lifetime : 3600 seconds - Mode : tunnel - Perfect Forward Secrecy : Diffie-Hellman Group 2 IPSec Dead Peer Detection (DPD) will be enabled on the AWS Endpoint. We recommend configuring DPD on your endpoint as follows: - DPD Interval : 10 - DPD Retries : 3 IPSec ESP (Encapsulating Security Payload) inserts additional headers to transmit packets. These headers require additional space, which reduces the amount of space available to transmit application data. To limit the impact of this behavior, we recommend the following configuration on your Customer Gateway: - TCP MSS Adjustment : 1379 bytes - Clear Don't Fragment Bit : enabled - Fragmentation : Before encryption #3: Tunnel Interface Configuration Your Customer Gateway must be configured with a tunnel interface that is associated with the IPSec tunnel. All traffic transmitted to the tunnel interface is encrypted and transmitted to the Virtual Private Gateway. The Customer Gateway and Virtual Private Gateway each have two addresses that relate to this IPSec tunnel. Each contains an outside address, upon which encrypted traffic is exchanged. Each also contain an inside address associated with the tunnel interface. The Customer Gateway outside IP address was provided when the Customer Gateway was created. Changing the IP address requires the creation of a new Customer Gateway. The Customer Gateway inside IP address should be configured on your tunnel interface. Outside IP Addresses: - Customer Gateway : 122.131.251.26 - Virtual Private Gateway : 13.230.113.189 Inside IP Addresses - Customer Gateway : 169.254.177.182/30 - Virtual Private Gateway : 169.254.177.181/30 Configure your tunnel to fragment at the optimal size: - Tunnel interface MTU : 1436 bytes #4: Border Gateway Protocol (BGP) Configuration: The Border Gateway Protocol (BGPv4) is used within the tunnel, between the inside IP addresses, to exchange routes from the VPC to your home network. Each BGP router has an Autonomous System Number (ASN). Your ASN was provided to AWS when the Customer Gateway was created. BGP Configuration Options: - Customer Gateway ASN : 65000 - Virtual Private Gateway ASN : 64512 - Neighbor IP Address : 169.254.177.181 - Neighbor Hold Time : 30 Configure BGP to announce routes to the Virtual Private Gateway. The gateway will announce prefixes to your customer gateway based upon the prefix you assigned to the VPC at creation time. IPSec Tunnel #2 ================================================================================ #1: Internet Key Exchange Configuration Configure the IKE SA as follows: Please note, these sample configurations are for the minimum requirement of AES128, SHA1, and DH Group 2. Category "VPN" connections in the GovCloud region have a minimum requirement of AES128, SHA2, and DH Group 14. You will need to modify these sample configuration files to take advantage of AES256, SHA256, or other DH groups like 2, 14-18, 22, 23, and 24. NOTE: If you customized tunnel options when creating or modifying your VPN connection, you may need to modify these sample configurations to match the custom settings for your tunnels. Higher parameters are only available for VPNs of category "VPN," and not for "VPN-Classic". The address of the external interface for your customer gateway must be a static address. Your customer gateway may reside behind a device performing network address translation (NAT). To ensure that NAT traversal (NAT-T) can function, you must adjust your firewall !rules to unblock UDP port 4500. If not behind NAT, and you are not using an Accelerated VPN, we recommend disabling NAT-T. If you are using an Accelerated VPN, make sure that NAT-T is enabled. - IKE version : IKEv2 - Authentication Method : Pre-Shared Key - Pre-Shared Key : C2agO4BPcD5.8buhLBtSHPX8xgjfJUzG - Authentication Algorithm : sha1 - Encryption Algorithm : aes-128-cbc - Lifetime : 28800 seconds - Phase 1 Negotiation Mode : main - Diffie-Hellman : Group 2 #2: IPSec Configuration Configure the IPSec SA as follows: Category "VPN" connections in the GovCloud region have a minimum requirement of AES128, SHA2, and DH Group 14. Please note, you may use these additionally supported IPSec parameters for encryption like AES256 and other DH groups like 2, 5, 14-18, 22, 23, and 24. NOTE: If you customized tunnel options when creating or modifying your VPN connection, you may need to modify these sample configurations to match the custom settings for your tunnels. Higher parameters are only available for VPNs of category "VPN," and not for "VPN-Classic". - Protocol : esp - Authentication Algorithm : hmac-sha1-96 - Encryption Algorithm : aes-128-cbc - Lifetime : 3600 seconds - Mode : tunnel - Perfect Forward Secrecy : Diffie-Hellman Group 2 IPSec Dead Peer Detection (DPD) will be enabled on the AWS Endpoint. We recommend configuring DPD on your endpoint as follows: - DPD Interval : 10 - DPD Retries : 3 IPSec ESP (Encapsulating Security Payload) inserts additional headers to transmit packets. These headers require additional space, which reduces the amount of space available to transmit application data. To limit the impact of this behavior, we recommend the following configuration on your Customer Gateway: - TCP MSS Adjustment : 1379 bytes - Clear Don't Fragment Bit : enabled - Fragmentation : Before encryption #3: Tunnel Interface Configuration Your Customer Gateway must be configured with a tunnel interface that is associated with the IPSec tunnel. All traffic transmitted to the tunnel interface is encrypted and transmitted to the Virtual Private Gateway. The Customer Gateway and Virtual Private Gateway each have two addresses that relate to this IPSec tunnel. Each contains an outside address, upon which encrypted traffic is exchanged. Each also contain an inside address associated with the tunnel interface. The Customer Gateway outside IP address was provided when the Customer Gateway was created. Changing the IP address requires the creation of a new Customer Gateway. The Customer Gateway inside IP address should be configured on your tunnel interface. Outside IP Addresses: - Customer Gateway : 122.131.251.26 - Virtual Private Gateway : 52.194.121.10 Inside IP Addresses - Customer Gateway : 169.254.202.74/30 - Virtual Private Gateway : 169.254.202.73/30 Configure your tunnel to fragment at the optimal size: - Tunnel interface MTU : 1436 bytes #4: Border Gateway Protocol (BGP) Configuration: The Border Gateway Protocol (BGPv4) is used within the tunnel, between the inside IP addresses, to exchange routes from the VPC to your home network. Each BGP router has an Autonomous System Number (ASN). Your ASN was provided to AWS when the Customer Gateway was created. BGP Configuration Options: - Customer Gateway ASN : 65000 - Virtual Private Gateway ASN : 64512 - Neighbor IP Address : 169.254.202.73 - Neighbor Hold Time : 30 Configure BGP to announce routes to the Virtual Private Gateway. The gateway will announce prefixes to your customer gateway based upon the prefix you assigned to the VPC at creation time. Additional Notes and Questions ================================================================================ - Amazon Virtual Private Cloud Getting Started Guide: http://docs.amazonwebservices.com/AmazonVPC/latest/GettingStartedGuide - Amazon Virtual Private Cloud Network Administrator Guide: http://docs.amazonwebservices.com/AmazonVPC/latest/NetworkAdminGuide |
参考サイト
https://changineer.info/network/vyatta/vyatta_ipsec_aws.html#google_vignette
https://changineer.info/network/vyatta/vyatta_ipsec_nat.html