Lecture 100: Hands On: Setup AWS Site-to-Site VPN
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：30:59
- 来源：Udemy Lecture 26077586
- Slide 数量：18
- 画面切换：05:06、05:22、06:46、08:09、10:35、11:38、12:46、13:43、14:28、15:08、17:24、18:44、20:55、24:17、26:23、28:25、30:10
扫描说明
逐条检查了 Udemy 页面中的 392 条 Transcript cue，并以每条 cue 对应画面为时间轴逐段扫描全长约 30:59 的实验视频。依据拓扑与步骤 Slide，以及 AWS 控制台、VPN 配置文件、Libreswan 终端配置、路由验证和清理等 16 个关键操作阶段，共划分出 18 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 实验目标拓扑与路由设计
时间范围：00:00–05:06
总结 / Summary
中文
实验用两个 AWS 区域模拟混合网络（hybrid network）：孟买区域作为 AWS 网络，包含私有子网（private subnet）与 EC2-A；北弗吉尼亚区域模拟数据中心（data center），包含公网子网（public subnet）中的 VPN 服务器和私有子网中的 EC2-B。站点到站点 VPN（Site-to-Site VPN）连接虚拟私有网关（Virtual Private Gateway, VGW）与运行 Libreswan 的 VPN 服务器；两侧路由表（route table）和安全组（security group）允许 EC2-B 经 VPN 服务器访问 EC2-A。
English
The lab uses two AWS Regions to simulate a hybrid network. Mumbai represents the AWS network with a private subnet and EC2-A, while Northern Virginia represents the data center with a public-subnet VPN server and private-subnet EC2-B. A Site-to-Site VPN connects a VGW to a Libreswan server, with route tables and security groups permitting EC2-B to reach EC2-A through the VPN server.
Transcript
00:00 Alright, so now let's do an exercise for AWS side-to-side VPN.
00:05 So the ideal way to do is to connect AWS VPC to your on-premises data center network, something
00:12 like this, where you will have the VPN router, which connects to VGW or the transit gateway
00:19 on AWS side over a IPsec VPN connection.
00:23 And then you should be able to access these servers on both the sides over their private IPs.
00:29 Now, while that's the ideal architecture, but because we don't have this on-premises
00:34 customer network, we will simulate that network for this exercise.
00:39 And for that, we will have another VPC in some other AWS region.
00:44 And in that we will have a VPN server configured on one of the EC2 instance.
00:50 So this VPN server will act as a VPN router, which will further send the traffic to the
00:56 other servers inside the same network.
00:59 So for this, the architecture is something like this, where on the left side, it is AWS network.
01:06 And on the right side, it is simulated customer network.
01:09 And on AWS side, if you see, we just have the VPC with one private subnet.
01:15 And in that we will have EC2 instance with only the private IP, which means in order
01:20 to reach to this EC2 instance from say customer network, we can only use the VPN connectivity.
01:27 So for this, we will use virtual private gateway, which is attached to the VPC, which is one
01:33 end of the VPN connection.
01:35 And the other end will terminate on this EC2 VPN server.
01:39 And for this VPN server, we will use some open source software like LibreSwan.
01:45 Now in the enterprise world, you will see different VPN servers like Cisco VPN or Juniper VPN.
01:51 But here we are going with the open source VPN server.
01:55 So we will use this LibreSwan VPN to configure this site to site VPN connectivity.
02:02 And once that is done, we should be able to then connect from this EC2 instance B to this
02:07 EC2 instance A over this VPN connection, right?
02:12 So that's the goal of the exercise.
02:15 And before we follow the steps, I just wanted to show you the root tables that you will
02:18 configure for these different subnets, as well as the security groups for these EC2 instances.
02:25 Alright, so on the left side, it's AWS network, and we will have one private subnet.
02:31 And the CIDR range for this VPC will be 10.0.0.0 slash 16.
02:36 So we will have this local route here.
02:38 And additionally, we would have to add the route saying that traffic going to on-premises
02:43 network that is 192.168.0.0 slash 16 should go through the virtual private gateway or
02:50 the VPN gateway.
02:52 So that will be the route table here.
02:54 Then comes the route table for this public subnet.
02:57 This is in a public subnet because it needs to have the public IP so that this VPN connection
03:02 can be established.
03:03 Further, we will also SSH into this instance so that we can install this LibreSwan software. Right.
03:11 So for this subnet, it will be simply a public subnet route table.
03:15 Now finally, for this private subnet, if you see, there will be the local route, of course.
03:20 And additionally, in order to send or receive the traffic from the AWS network, we will
03:25 have additional route for this destination and the traffic will go through this particular instance.
03:32 So as a target, we will have this VPN server instance there. Right.
03:38 So these are the route tables that we need to configure here. Alright.
03:42 Now with respect to the security groups, typically we will just have the ping rule that is ICMP.
03:47 So here on the left side for this EC2 instance A, we will just allow the ICMP from this network.
03:54 Further, for this particular VPN server EC2 instance, we will have the SSH enabled because
04:01 we want to SSH from my machine and configure the VPN server.
04:05 And also we will allow ICMP from anywhere because this machine can also ping it and
04:10 this machine can also ping it.
04:12 Finally, here we will allow the SSH from this network only because if we want to test connectivity
04:18 from EC2 instance B to EC2 instance A, we need to first SSH into that.
04:24 Now being in a private subnet, the only way to reach to this machine is from this particular VPN server.
04:30 So we will SSH into this and from there we will SSH into this EC2 B. That's where this rule is there.
04:37 Then we will also allow ICMP from AWS network so that we can test both way connectivity. All right.
04:46 So that's our target architecture.
04:47 And at this point, because you know AWS well, I'm expecting that you should be able to configure
04:54 at least at network layer, everything that you see on this slide, right?
04:59 And that's where I will be going a little fast here and all the steps I have also given in the slides.
2. 实验执行步骤总览
时间范围：05:06–05:22
总结 / Summary
中文
实验顺序是：创建两侧虚拟私有云（Virtual Private Cloud, VPC）、子网（subnet）、路由表（route table）和 EC2 实例；创建虚拟私有网关（VGW）、客户网关（Customer Gateway, CGW）与 VPN 连接；下载配置并在 Libreswan 上建立隧道；配置静态路由（static route）与源/目标检查（source/destination check）；最后验证端到端连通性并清理计费资源。
English
The workflow creates both VPC environments and instances, builds the VGW, Customer Gateway, and VPN connection, downloads the generated configuration, establishes the tunnel on Libreswan, configures static routing and source/destination checking, validates end-to-end connectivity, and then removes billable resources.
Transcript
05:06 So you can also read through them. All right.
05:09 So in this exercise, we will first set both the VPCs, we will launch the EC2 instances
05:13 and then we will set up the VPN connectivity. Right?
05:17 So let's go to the AWS console and create these VPCs. Okay.
3. 创建 AWS 侧 VPC、私有子网与路由表
时间范围：05:22–06:46
总结 / Summary
中文
在孟买区域创建 AWS-VPC，CIDR 为 10.0.0.0/16，并创建 10.0.0.0/24 私有子网（private subnet）。该 VPC 不需要互联网网关（Internet Gateway, IGW）；为私有子网建立专用路由表（private route table）并显式完成子网关联（subnet association），为后续指向 VGW 的数据中心路由预留位置。
English
In Mumbai, the lab creates AWS-VPC with 10.0.0.0/16 and a 10.0.0.0/24 private subnet. This VPC does not need an Internet Gateway. A dedicated private route table is created and explicitly associated with the subnet, ready for the later route toward the VGW.
Transcript
05:22 So here I have four tabs open.
05:24 So I'll be using Mumbai region as my AWS network and I'll be using North Virginia region as
05:29 my data center network.
05:32 And then I have two tabs for EC2 instances.
05:35 So it is better you open these tabs side by side. All right.
05:39 So let's create the AWS side of the VPC and let's call it AWS VPC.
05:47 And the range is 10.0.0 slash 16. That's it.
05:53 Let's create the VPC.
05:54 Now, if you see the diagram, we don't need the internet gateway in this VPC, we just
05:58 need a private subnet.
06:01 So let's go to the subnets and let's create the private subnet.
06:05 And let's give it a name, say AWS side of the private subnet.
06:15 I can choose any AC and I can choose the range 10.0.0 slash 24. That's it.
06:23 Let's create the subnet. All right.
06:25 Also, let's create a specific root table for this subnet.
06:30 So let's call it AWS private root table.
06:35 And this will be an AWS VPC.
06:39 And we need to associate that with our subnet.
06:43 All right, so we created the VPC and the subnet.
4. 启动 AWS 侧 EC2-A
时间范围：06:46–08:09
总结 / Summary
中文
在 AWS-VPC 的私有子网中启动 EC2-A，禁用自动分配公网 IP（auto-assign public IP）。安全组（security group）允许来自数据中心 CIDR 192.168.0.0/16 的全部 ICMP IPv4，以便隧道建立后从模拟本地网络进行 ping 测试。
English
EC2-A is launched in the private subnet of AWS-VPC with automatic public IPv4 assignment disabled. Its security group permits all ICMP IPv4 from the simulated data-center CIDR 192.168.0.0/16 so that reachability can be tested after the tunnel is established.
Transcript
06:46 And now let's launch this EC2 instance with the private IP.
06:51 Okay, so let's go to the EC2 in the Mumbai region.
06:54 So make sure that you are in the right region again.
06:57 And let's launch the instance.
06:59 Okay, let's call it EC2-A.
07:04 And let's select the right SSH key pair.
07:09 And let's change the network to AWS VPC.
07:13 And there is only one subnet, autosign public IP, we need to disable and the security group.
07:19 So let's call it AWS app SG.
07:27 And we want to allow all ICMP from right side of the network.
07:33 And that is our CIDR range for the data center that is 192.168.0.0 slash 16.
07:44 That's it really let's launch this instance. All right.
07:50 So we have created this side of the network and the EC2 instance.
07:54 And we will create this virtual private gateway little later.
07:58 But before that, we will set up the right side of the network.
08:00 So we will create this DC VPC, we will create these two subnets.
08:04 And then we will launch EC2 instances in those subnets. All right.
5. 创建模拟数据中心 VPC 与双子网
时间范围：08:09–10:35
总结 / Summary
中文
在北弗吉尼亚区域创建 DC-VPC，CIDR 为 192.168.0.0/16，并挂载互联网网关（Internet Gateway, IGW）。公网子网（public subnet）使用 192.168.0.0/24，并通过公网路由表（public route table）的 0.0.0.0/0 路由访问 IGW；私有子网（private subnet）使用 192.168.100.0/24，并关联独立的私有路由表。
English
In Northern Virginia, DC-VPC is created with 192.168.0.0/16 and an attached Internet Gateway. The 192.168.0.0/24 public subnet uses a public route table with a 0.0.0.0/0 route to the IGW, while the 192.168.100.0/24 private subnet is associated with its own private route table.
Transcript
08:09 Okay, so let's go to the North Virginia region, just make sure that you are in North Virginia.
08:15 And let's call this VPC as data center VPC and the CIDR range as 192.168.0.0 slash 16. And that's it.
08:27 Let's create that.
08:30 And for this VPC, we need internet gateway because we need to SSH into the machines.
08:35 So the first thing you should do, let's go to the internet gateway.
08:40 And let's call it DC internet gateway.
08:45 And also let's attach it to the VPC.
08:48 All right, that's done.
08:51 Now let's go to the subnets.
08:53 And let's create two subnets.
08:54 The first is a public subnet.
08:58 So let's call it DC public subnet in one of the EC.
09:05 And let's give it a range 192.168.0.0 slash 24.
09:10 And let's add a private subnet as well.
09:13 So let's call it DC private subnet in the same EC.
09:19 And let's give it a different range this time 192.168.100.0 slash 24.
09:26 All right, let's create the subnets.
09:30 And now let's create the root tables for both the subnets so that we can manage the root better.
09:36 So let's call it DC public root table for this VPC.
09:46 And because it's a public, we need to add the root for the internet gateway.
09:50 So let's add a root for 0.0.0.0 slash 0 through the internet gateway.
09:58 And at this point, don't forget to associate this root table with our subnet.
10:03 Most of the time, generally, people will forget that and then it won't work as expected.
10:09 So this is for my public subnet.
10:11 So let's save that. All right.
10:13 Similarly, let's now create another root table for the private subnet.
10:18 So let's call it DC private root table.
10:23 And this time, we don't need to add any root, we just need to make sure that it is associated
10:28 with the private subnet.
10:32 Alright, so this is done.
6. 启动公网 VPN Server
时间范围：10:35–11:38
总结 / Summary
中文
在 DC-VPC 的公网子网中启动 VPN Server，启用公网 IP（public IP），并使用 Amazon Linux 2023。VPN Server 安全组（security group）开放 SSH 以便管理，同时允许 ICMP IPv4 用于测试；实验为便于演示使用较宽来源范围，生产环境应限制到可信管理地址。
English
The VPN Server is launched with Amazon Linux 2023 in the public subnet of DC-VPC and receives a public IP. Its security group allows SSH for administration and ICMP IPv4 for testing. The lab uses broad sources for convenience, but production deployments should restrict them to trusted management addresses.
Transcript
10:35 Now next we need to go to the EC2 and launch two instances, one in the public subnet that
10:41 will act as our VPN server.
10:43 So let's call it VPN server.
10:46 And again, this is in North Virginia.
10:50 So you should have your SSH key already created there.
10:53 And let's edit the network setting and choose the VPC that we created.
10:58 And it should be in a public subnet. Remember that.
11:02 And it should also have the public IP so that we can create the VPN connection.
11:07 So make sure that you enable the public IP.
11:10 All right, with respect to the security group, let's give it a name VPN server SG.
11:17 And let's allow SSH from anywhere so that I can log in.
11:22 And also let's allow all ICMP IPv4 again from anywhere it's okay.
11:30 Alright, let's launch the instance.
11:33 So that's my VPN server instance.
7. 启动私有 EC2-B
时间范围：11:38–12:46
总结 / Summary
中文
在 DC-VPC 的私有子网中启动 EC2-B，不分配公网 IP（public IP）。其安全组（security group）允许来自数据中心网络的 SSH，并允许来自 AWS VPC CIDR 10.0.0.0/16 的 ICMP；EC2-B 将作为最终端到端 VPN 通信测试的本地工作负载。
English
EC2-B is launched without a public IP in the private subnet of DC-VPC. Its security group permits SSH from the data-center network and ICMP from the AWS VPC CIDR 10.0.0.0/16. EC2-B serves as the on-premises workload for the final end-to-end VPN test.
Transcript
11:38 And similarly, let's launch another instance that is EC2B for testing the connectivity.
11:46 So let's call it EC2B in the same VPC.
11:59 But make sure that it is in the private subnet.
12:02 And we don't need public IP that is okay.
12:05 And again, we need to have the security group.
12:12 And it should allow SSH from 192 range so that I can go from the VPN server to this
12:19 server 192.168.0.0 slash 16.
12:26 And let's also allow the all ICMP so that we can ping from the AWS side of the network.
12:33 So here I can put say 10.0.0.0 slash 16.
12:40 Alright, I think we are good.
12:42 So let's launch the instance.
8. 映射 VGW、CGW 与 VPN Server
时间范围：12:46–13:43
总结 / Summary
中文
AWS 端由虚拟私有网关（Virtual Private Gateway, VGW）终止 VPN；客户侧由客户网关（Customer Gateway, CGW）对象表示。CGW 不是实际设备，而是 AWS 中对远端 VPN 端点的定义，因此创建时要填入 VPN Server 的公网 IP 和自治系统编号（Autonomous System Number, ASN）。
English
A Virtual Private Gateway terminates the VPN on the AWS side, while a Customer Gateway object represents the remote endpoint. The CGW is not the physical or virtual appliance itself; it is the AWS definition of that endpoint, using the VPN Server public IP and an ASN.
Transcript
12:46 Okay, so which means we are done with all these settings with respect to the root table,
12:53 security groups and the instances.
12:55 And now let's do the most important thing that is creating this virtual private gateway,
13:00 the customer gateway.
13:02 And then let's configure this VPN server.
13:04 Alright, so for creating the VPN connection on AWS side.
13:09 You need the virtual private gateway, which you attach to the VPC.
13:13 And then you need to represent the customer network in the form of customer gateway.
13:19 Now for creating that customer gateway, you have to use the public IP of this VPN server.
13:24 So while you create the customer gateway on the AWS side, actually it represents the other network.
13:30 So we will use the public IP of this VPN server for creating the customer gateway.
13:35 And then we will create the VPN connection between the virtual private gateway and the
13:40 customer gateway.
13:41 So now let's do that.
9. 创建并挂载 Virtual Private Gateway
时间范围：13:43–14:28
总结 / Summary
中文
在孟买区域创建虚拟私有网关（Virtual Private Gateway, VGW），然后将其挂载到 AWS-VPC。VGW 是 AWS 托管的站点到站点 VPN（Site-to-Site VPN）端点；只有状态变为 Available 并正确关联 VPC 后，才能用于创建 VPN 连接。
English
A Virtual Private Gateway is created in Mumbai and attached to AWS-VPC. The VGW is the AWS-managed Site-to-Site VPN endpoint and must become Available and be associated with the correct VPC before it can be selected for a VPN connection.
Transcript
13:43 Alright, so for creating the virtual private gateway, we need to go back to the Mumbai
13:48 region, which represents AWS side of the network.
13:51 And if you just go down here, you will see virtual private gateway.
13:55 So let's create a new virtual private gateway.
13:58 So let's call it AWS network virtual private gateway. And that's it.
14:10 And we need to attach it to the VPC.
14:13 So let's let it create first.
14:15 Currently, it's in a detachment, okay, it is available.
14:19 So let's just attach to the VPC. And that's it.
14:25 So this is the AWS side of the VPN gateway.
10. 创建 Customer Gateway
时间范围：14:28–15:08
总结 / Summary
中文
创建客户网关（Customer Gateway, CGW），使用 VPN Server 的公网 IP 作为设备地址，并保留默认私有自治系统编号（private ASN）。这个 CGW 代表模拟数据中心网络，是后续 VPN 连接的远端端点。
English
The Customer Gateway is created with the VPN Server public IP and the default private ASN. This CGW represents the simulated data-center network and becomes the remote endpoint selected by the VPN connection.
Transcript
14:28 Now we need to connect this to the customer gateway, which represent the customer network.
14:33 So let's create the customer gateway.
14:35 And here it represents the data center network customer gateway.
14:41 So ASN, we will go with the default and IP address should be the public IP of your VPN server.
14:48 So let's go to the North Virginia EC2 instance.
14:51 Let's refresh this.
14:54 And let's grab the public IP of this instance, which is this.
14:58 So let's go here and create that.
15:00 Now rest of the settings, let's go as default.
15:04 Alright, so customer gateway has been created.
11. 创建静态路由 Site-to-Site VPN
时间范围：15:08–17:24
总结 / Summary
中文
在 VGW 与 CGW 之间创建站点到站点 VPN（Site-to-Site VPN）。由于实验使用的 Libreswan 不配置边界网关协议（Border Gateway Protocol, BGP），路由类型选择静态（static），远端网络 CIDR 填写 192.168.0.0/16。AWS 为连接生成两条 IPsec 隧道（IPsec tunnel）、公网隧道端点和预共享密钥（pre-shared key, PSK）；远端尚未配置时两条隧道均显示 Down。
English
A Site-to-Site VPN is created between the VGW and CGW. Because the lab does not configure BGP on Libreswan, static routing is selected with 192.168.0.0/16 as the remote network. AWS generates two IPsec tunnels, public tunnel endpoints, and pre-shared keys; both tunnels initially show Down because the remote endpoint is not yet configured.
Transcript
15:08 Now the next important part is to create the VPN connection.
15:12 So for that, let's go to the site to site VPN connection.
15:15 And let's create a new connection.
15:17 So let's call it AWS data center VPN.
15:22 So the target type is virtual private gateway on the AWS side.
15:25 So let's select that.
15:26 And other side is customer gateway, which we already created.
15:30 Alright, now here with respect to the routing option, because we are using the LibreSwan
15:35 on the other side, it doesn't support the dynamic routing.
15:38 So we have to go with the static routing.
15:42 But otherwise, if you are using the Cisco VPN or Juniper, you might also go with the
15:46 dynamic that is BGP routing.
15:49 And I will probably show you this when we talked about the VPN connection between AWS
15:54 and the Google Cloud or the Azure Cloud.
15:57 Alright, now with respect to the static routing, we need to know what is the target network CIDR range.
16:03 So on-premise data center range is 192.168.00.16.
16:10 Now because it uses this range to set the static route on the VGW side, that is virtual
16:16 private gateway side.
16:17 Alright, now rest of the settings we will leave as it is.
16:21 And let's create this VPN connection.
16:24 Okay, so maybe it will take a minute or so for this VPN connection to be completely up.
16:31 But that doesn't really finish our exercise because we have just completed AWS side of
16:35 the configuration.
16:36 Now, we need to use this VPN settings to configure our actual VPN server on the other side of the network.
16:43 And for that, we need the VPN configuration file from AWS side, which has all these parameters.
16:49 Like what are the IP addresses of the VPN server on the AWS side?
16:53 What are the pre-shared secrets that needs to be configured?
16:57 So if you go here, and if you just see these details, you will find quite interesting thing.
17:02 For example, AWS creates two tunnels, as you know, for high availability.
17:07 And these are the public IPs that it creates for those two tunnels.
17:13 And as of now, the tunnels are down because we haven't configured the other end.
17:17 So there are tunnel details, there are pre-shared keys and everything, which is there in this
17:22 configuration file, which you need to download.
12. 下载并审阅 VPN 配置文件
时间范围：17:24–18:44
总结 / Summary
中文
从 VPN 连接下载 OpenSwan 兼容配置，选择 Internet Key Exchange v1（IKEv1）。文本文件包含两条隧道的公网 IP、内部地址、预共享密钥（PSK）、加密参数以及 sysctl.conf、ipsec.conf 的示例设置。OpenSwan、StrongSwan 与 Libreswan 参数相近，但需要按实际软件版本调整。
English
An OpenSwan-compatible configuration is downloaded using IKEv1. The text file contains public and inside addresses, pre-shared keys, cryptographic parameters, and example sysctl.conf and ipsec.conf settings for both tunnels. OpenSwan, StrongSwan, and Libreswan are similar, but version-specific adjustments may be required.
Transcript
17:24 So let's download the configuration file.
17:26 And the vendor is OpenSwan, or you can go with the generic, but I think it provides
17:31 the OpenSwan as an option.
17:33 So OpenSwan, StrongSwan, or LibreSwan all have similar parameters.
17:37 So you can just go for OpenSwan.
17:40 Now with respect to the iKey version, we can go with iKey 1 or 2.
17:43 So let's go with the default, that is 1.
17:46 And let's download.
17:49 So you need to save this configuration file as a text file.
17:51 So I'm saving that.
17:53 And shortly, I will open this file and I will show you the details in this file.
17:58 Alright, so this file basically contains everything that you need to know to configure the right
18:05 side of the network.
18:06 So there are two tunnel details.
18:07 So this is for tunnel 1.
18:09 You need to configure a lot of things on the VPN server.
18:12 For example, you need to configure sysctl.conf and set these parameters.
18:17 Then you need to configure ipsec.conf and in that you need to add these connection details.
18:23 Now these details won't be exactly as it is because depending on the VPN software that
18:28 you use on the right side, some of the settings might change.
18:32 And I will let you know while I configure that.
18:35 Okay, so you can just follow these instructions and you can do everything on the VPN server there.
18:42 And that's what I'm going to do.
13. 连接 VPN Server 并准备 Libreswan
时间范围：18:44–20:55
总结 / Summary
中文
通过 EC2 Instance Connect 登录 VPN Server，安装 Libreswan。按照配置文件修改内核参数（kernel parameters）并运行 sysctl -p 使其生效，然后检查 /etc/ipsec.conf，确认包含 /etc/ipsec.d/*.conf 的 include 指令未被注释，以便加载后续 AWS 隧道配置。
English
The lab connects to the VPN Server through EC2 Instance Connect and installs Libreswan. Kernel parameters are added and applied with sysctl -p, and /etc/ipsec.conf is checked to ensure the include directive for /etc/ipsec.d/*.conf is active so the AWS tunnel configuration will be loaded.
Transcript
18:44 So first thing I need to SSH into the VPN server on the right side.
18:48 And that is our this VPN server.
18:50 So let me SSH into that.
18:52 Alright, so because I opened the security group for the world, I can directly SSH from
18:58 here through the console using the EC2 instance connect.
19:02 So let me connect.
19:11 Now one thing to make sure that all these instances are launched using Amazon Linux 2023 AMI.
19:19 Now in the future, if AWS launches new AMIs, then it is possible that you would have to
19:25 change some commands or some steps there. Right? Alright.
19:30 So in order to get into this VPN server, the first thing that you should do is to install
19:35 the LibreSwan VPN software.
19:37 So let's say yum install LibreSwan and all these commands I have given with the slides
19:42 so you can refer to them.
19:46 Alright, so LibreSwan has been installed.
19:52 Now next, we need to edit the cctl.conf file and add these three entries there and then
19:58 run the command cctl-p to apply those changes.
20:02 So let's do that.
20:04 And I'm using the sudo command because I'm not root here.
20:08 So let's say vi slash etc cctl.conf.
20:15 And let's go towards the end and let's paste the content. That's it.
20:23 Let's save the file and let's say sudo cctl-p to apply the changes. Alright.
20:32 Next we want to make sure that slash etc ipsec.conf file contains this entry without hash.
20:39 So let's make sure that.
20:41 So I'm just doing cat to see the content ipsec.conf.
20:47 So at the end, there shouldn't be hash before this include.
20:51 So this file looks good.
20:52 We don't need to do anything.
14. 配置 aws.conf、Secrets 并启动 IPsec
时间范围：20:55–24:17
总结 / Summary
中文
在 /etc/ipsec.d/aws.conf 中配置第一条隧道，并根据 Libreswan 调整算法：移除重复的 auth=esp，更新第二阶段算法（Phase 2 algorithm）与 IKE 参数，同时把 leftsubnet 设为 192.168.0.0/16、rightsubnet 设为 10.0.0.0/16。随后在 aws.secrets 写入预共享密钥（PSK），启动 ipsec.service 并检查运行状态与握手日志。
English
Tunnel 1 is configured in /etc/ipsec.d/aws.conf. For Libreswan, the redundant auth=esp line is removed, Phase 2 and IKE algorithms are updated, leftsubnet is set to 192.168.0.0/16, and rightsubnet to 10.0.0.0/16. The pre-shared key is written to aws.secrets, ipsec.service is started, and its status and handshake logs are checked.
Transcript
20:55 Alright next we need to create this aws.conf file in the ipsec.d directory and also later
21:01 aws.secrets file in the same directory.
21:05 And in this file we will configure the tunnel1 detail.
21:09 So let's do that now.
21:10 Alright so let's do sudo vi and the file.
21:18 And let's go into the insert mode and paste the content from the VPN configuration text file.
21:25 So I'm just copying this content from here and simply pasting it here.
21:31 Alright now you need to make some changes to this file and this is the most important
21:36 thing if you are using say libre swan or open swan or strong swan as a VPN server.
21:42 So the first thing you need to remove this auth equal to esp because this is already
21:47 covered under this phase 2 algorithm and ikey handshake.
21:51 So that's first thing.
21:53 Second you need to change these algorithms because these are not considered to be the
21:57 strongest cipher suits that is being used by the ipsec VPN connectivity.
22:02 So we need to make some changes to this.
22:05 And for that just refer to this slide where I have provided all these details.
22:10 So you need to first remove this auth equal to esp and you need to change phase 2 algorithm
22:15 to this value and the ikey value to this value.
22:19 So let me also do the same.
22:21 Alright so I'm just deleting these two lines and instead pasting the content from the slide
22:30 and just adjust this indentation a little.
22:37 Alright now another thing you need to configure the left subnet and the right subnet.
22:42 Now here the left subnet means the actual side where we are configuring this and because
22:46 it is a data center site the left side is its own and that is a network that is 192.168.0.0
22:56 slash 16 and the right side is other network which is the AWS side of the network and the
23:02 VPC side that we need to put is this.
23:08 Alright so everything is done.
23:10 So here remember that you need to change these two parameters.
23:13 You need to remove auth equal to esp and then you have to configure left and right subnet.
23:19 Alright let's save it.
23:21 Now similarly let's create another file called secrets and in that we need to provide the
23:26 secrets which are again there in the VPN configuration file that we downloaded.
23:31 So here again for the tunnel one if you see here this is a line that we need to add.
23:37 So let's just copy that.
23:39 Alright so I'm just pasting the secrets content and saving the file.
23:46 Alright so everything is done.
23:48 The last thing that we need to do is to sudo systemctl start ipsec.service.
23:58 Alright that's done.
23:59 Now let's check the status.
24:06 Okay it's showing it as running and we see some handshake happening there.
24:12 But that doesn't always mean that the tunnel has been established successfully.
15. 补充 AWS 私有路由并确认 Tunnel Up
时间范围：24:17–26:23
总结 / Summary
中文
首次从 VPN Server ping EC2-A 失败，是因为 AWS 私有子网路由表（private route table）还不知道如何到达 192.168.0.0/16。添加目标为 VGW 的静态路由（static route）后流量立即通过；在 VPN 连接的 Tunnel details 中可以看到一条隧道变为 Up。实验只配置第一条隧道，第二条保持 Down。
English
The first ping from the VPN Server to EC2-A fails because the AWS private-subnet route table lacks a route to 192.168.0.0/16. After a static route targeting the VGW is added, traffic begins to flow and one tunnel shows Up in the VPN connection details. Only Tunnel 1 is configured in this lab, so Tunnel 2 remains Down.
Transcript
24:17 So the best test that we can do is to just try to ping to the private IP of EC2 instance
24:21 A. So basically we are on this machine and from this VPN server we need to test the ping
24:27 to this EC2 instance A here. Right.
24:30 So for that let's go to the Mumbai region again.
24:33 Let's go to the instances and this EC2 instance A's private IP we need to grab that is 10.0.0.0.73.
24:42 So let's try to ping to this particular IP and you see currently it is not working.
24:51 And can you guess why?
24:53 Now let's go back to our diagram.
24:54 So potentially we have done everything that is required to be done here. Right.
24:59 We have set up the VPN connection, the tunnels and everything.
25:02 The only thing that is missing so far is the root table for this EC2 instance A's private
25:08 subnet and this is the entry that we want so that it knows how to route traffic to this other network.
25:15 So now let's do that. All right.
25:18 So let's go here to the Mumbai region and let's go to the root tables and let's go to
25:25 the let me refresh this private root table, routes, edit these routes, add the route because
25:32 it's a static route, we need to add ourself and the target is this network and it should
25:40 go through the virtual private gateway, which is this.
25:45 And let's just save that. All right.
25:48 Once that is done, you see the traffic started flowing from the VPN server to the EC2 instance A. Okay.
25:56 That means VPN is working as expected and you can verify that by just going down to
26:00 the VPN connection that is side to side VPN connection.
26:04 Just select the one and let's see the tunnel details and you see one of the tunnel is up.
26:09 Now we haven't configured another tunnel.
26:11 That's where it's down or otherwise, as I said in LibreSwan, it doesn't allow for both
26:16 the tunnels to be up at the same time.
26:18 So we will configure only one tunnel. All right. So that's done.
16. 关闭 Source/Destination Check 并配置 DC 私有路由
时间范围：26:23–28:25
总结 / Summary
中文
VPN Server 需要转发目的地址不是自身的流量，因此必须关闭源/目标检查（source/destination check）。随后在 DC 私有子网路由表（private route table）中添加 10.0.0.0/16 路由，目标选择 VPN Server 的实例网络接口（instance network interface），使 EC2-B 的 AWS 方向流量先到 VPN Server。
English
Because the VPN Server forwards packets whose destination is not the server itself, source/destination checking must be disabled. The DC private-subnet route table then receives a route for 10.0.0.0/16 targeting the VPN Server instance network interface, directing EC2-B traffic toward the VPN appliance.
Transcript
26:23 And that's not the full exercise, because if you see the architecture that we had, we
26:28 actually want to connect from this EC2 instance B to this A and for that we need to configure
26:33 the root table for this particular EC2 B to send the traffic through the VPN server.
26:41 And other than that, I forgot to tell you is that because now VPN server will act as
26:46 a router, you need to disable the source destination check for this instance.
26:52 Now, I'm not sure if you know about this, but it means that generally by default, any
26:57 EC2 instance will accept the traffic for which the destination is that instance.
27:02 So it will only accept the traffic where the destination IP is this VPN server's IP.
27:08 However, if you see EC2 B is going to ping to EC2 A and we are routing that traffic through
27:15 this VPN server.
27:16 So which means VPN server would have to accept the traffic where the target is not VPN server
27:21 and that's where we need to disable the source destination check setting for this instance. Right.
27:27 So now let's do these two settings.
27:29 First, this one and then we will modify the root table for this EC2 B subnet. All right.
27:36 So first let's go to the North Virginia EC2 instance VPN server and sorry, let's go to
27:40 the action networking, change this and stop the source destination checking.
27:47 Okay, that's done.
27:50 Now let's go to the root table for the private subnet.
27:56 Let's refresh this once and we need to have this private root table here.
28:03 Let's go to the roots and let's edit the roots and let's say if the traffic is for the AWS
28:11 side of the network, then it has to be routed through the instance and that instance is the VPN server.
28:21 And let's save the changes. All right.
28:24 So everything is done.
17. 从 EC2-B 验证端到端 VPN 连通性
时间范围：28:25–30:10
总结 / Summary
中文
先把 SSH 私钥（SSH private key）安全地复制到 VPN Server 并设置 400 权限，再从 VPN Server 通过私有 IP 登录 EC2-B。EC2-B 对 EC2-A 私有 IP 的 ping 成功，证明路径 EC2-B → VPN Server → IPsec VPN → VGW → EC2-A 已实现双向端到端连接（end-to-end connectivity）。
English
The SSH private key is copied to the VPN Server with mode 400, and the server then connects to EC2-B over its private IP. A successful ping from EC2-B to the private IP of EC2-A proves end-to-end bidirectional connectivity through EC2-B, the VPN Server, IPsec VPN, VGW, and EC2-A.
Transcript
28:25 Now the last thing we need to reach to the EC2 instance B. Now how do we reach to that instance?
28:30 Now, because we are already on VPN server here, we need to SSH into B from here.
28:36 However, we need to bring the SSH key so that we can SSH.
28:40 So for that, I need to first create the SSH key file here and this will be the same key
28:44 with which we launched the EC2 instance B.
28:47 So let me call it simply the key.pem file and paste the content of the North Virginia
28:53 SSH key that I had.
28:56 So I have these SSH key files already created.
28:58 So I'll just edit this and copy this content and I will simply paste this file content
29:05 here and save the file.
29:08 Now we need to change the permission to 400 for security and then we need to SSH minus
29:15 I with this file and the private IP address of EC2 instance B, which I can get from here, which is this.
29:25 So let me just paste the private IP. Let's say yes.
29:31 And you can see I am into the EC2 instance B. Now, if everything is perfect, the way
29:37 we want it, then we should be able to ping to the EC2 instance A on the AWS side and the IP was 73.
29:46 So let's just try.
29:49 And we are able to ping.
29:51 That means end-to-end connectivity is now working from EC2 instance B via the VPN server
29:56 to the EC2 instance A. Now, additionally, you can also do SSH because we have opened
30:02 the security group there, but this proves the end-to-end connectivity. All right.
18. 清理实验资源
时间范围：30:10–30:59
总结 / Summary
中文
实验资源会产生费用，应按依赖关系清理：终止三个 EC2 实例，删除 VPN 连接（VPN connection），解除虚拟私有网关（VGW）与 VPC 的关联，删除 VGW 和客户网关（CGW），最后删除 AWS-VPC 与 DC-VPC。先删除连接和挂载关系可以避免 VPC 或网关因依赖项仍存在而无法删除。
English
The lab resources incur charges and should be removed in dependency order: terminate all three EC2 instances, delete the VPN connection, detach the VGW from its VPC, delete the VGW and Customer Gateway, and finally delete AWS-VPC and DC-VPC. Removing connections and attachments first prevents dependency errors.
Transcript
30:10 So that's it really about this exercise.
30:12 Now, if you are also doing this exercise with me, then please don't forget to terminate
30:17 all your EC2 instances and the VPN connections because they incur charge.
30:24 So make sure that you terminate these three EC2 instances and then you terminate the VPN
30:29 connection and delete virtual private gateways and both these VPCs.
30:34 And the same thing I'm also going to do.
30:37 Now, all the steps for setting this VPN, all the commands are given in the slides,
30:42 which you can download from the link in the description. Right.
30:47 So I hope you will be able to do this and you understand now how the site-to-site VPN works in AWS.
30:54 So thanks for watching and stay tuned.
整讲总结 / Overall Summary
中文
本实验从零构建了一个可工作的 AWS 站点到站点 VPN（AWS Site-to-Site VPN）：两侧 VPC 与子网、VGW、CGW、静态路由 VPN、Libreswan 配置、预共享密钥（PSK）、路由表和源/目标检查（source/destination check）缺一不可。排障时要沿数据路径逐跳确认安全组、两侧返回路由、隧道状态与 Linux 转发配置。成功的 EC2-B 到 EC2-A ping 证明了完整的网络到网络（network-to-network）连通性；实验结束后必须及时清理所有计费资源。
English
This lab builds a working AWS Site-to-Site VPN from end to end. Both VPC environments, the VGW, CGW, statically routed VPN, Libreswan configuration, pre-shared key, route tables, and disabled source/destination checking are all required. Troubleshooting should follow the packet path and verify security groups, return routes on both sides, tunnel status, and Linux forwarding. The successful EC2-B-to-EC2-A ping proves network-to-network connectivity, after which all billable resources should be removed.
返回顶部 ↑