Site To Site IPSEC VPN Tunnel Between Google Cloud And AWS with pfSense

Been porting workloads from AWS to GCE lately and one big piece of infrastructure that I rely on is pfSense.

pfSense is a FreeBSD based appliance which does advanced routing, firewall and VPN for your cloud-based infrastructure. Using pfSense, one can establish IPSEC tunnels between the various AWS regions and the clients office network. While pfSense is available from the AWS Marketplace, it’s currently not yet available on Google Cloud.

Screen Shot 2015-02-26 at 22.42.51

StrongSwan is a viable replacement for environments where pfSense is not an option. Below is a working “site to site” StrongSwan configuration running on Ubuntu 14.04 LTS GCE instance and works with pfSense 2.2. Please note that pfSense 2.2 has moved from racoon to StrongSwan.

# apt-get install strongswan
conn myconn
  reqid = 1
  fragmentation = yes
  keyexchange = ikev1
  reauth = yes
  forceencaps = no
  rekey = yes
  installpolicy = yes
  type = tunnel
  dpdaction=restart
  dpddelay = 10s
  dpdtimeout = 60s
  auto = route
  left =  10.240.x.x # my private IP as assigned to eth0 on GCE instance 
  right = 103.x.x.x # the site I am connecting to
  leftid = 1.2.3.4 # my GCE ephemeral / static IP
  ikelifetime = 28800s
  lifetime = 3600s
  ike = aes256-sha1-modp1024!
  esp = aes256-sha1!
  leftauth = psk
  rightauth = psk
  rightid = 103.x.x.x # the site I am connecting to
  aggressive = no
  rightsubnet = 192.168.x.0/24 # my office private subnet
  leftsubnet = 10.240.0.0/16 # my GCE private network

Shanker Balan

Shanker Balan is a devops and infrastructure freelancer with over 14 years of industry experience in large scale Internet systems. He is available for both short term and long term projects on contract. Please use the Contact Form for any enquiry.

More Posts - Website

Follow Me:
TwitterLinkedIn

Mac OSX Cisco IPSEC Client Configuration

Updated #1 (20140415): The Cisco VPN configuration instructions are available in the Apple Enterprise Deployment Guide

How do you configure a IPSEC VPN server with Apple Mac OSX client compatibility?

There are various HOWTOs on the net that tell you how to configure various VPN appliances and IPSEC software (Racoon, StrongSwan, OpenSwan etc) to work with Apple Mac OSX and IOS devices. While you can continue to refer these HOWTOS, what if you could have access to the actual configuration information that a Mac OSX device uses to connect as a IPSEC client?

Continue reading Mac OSX Cisco IPSEC Client Configuration

Shanker Balan

Shanker Balan is a devops and infrastructure freelancer with over 14 years of industry experience in large scale Internet systems. He is available for both short term and long term projects on contract. Please use the Contact Form for any enquiry.

More Posts - Website

Follow Me:
TwitterLinkedIn

Automatic Installation Of Security Updates On Ubuntu

A new OpenSSL vulnerability called heartbleed has been found and patched. Information on the vulnerability is available on the CVE Website and there is even a dedicated site for the issue.

While most of us keep our system regularly update our systems using apt or yum, it is best advised have an automatic update process in place. This is to ensure that systems don’t get missed out in the update process and that the updates are applied as soon as possible.

Continue reading Automatic Installation Of Security Updates On Ubuntu

Shanker Balan

Shanker Balan is a devops and infrastructure freelancer with over 14 years of industry experience in large scale Internet systems. He is available for both short term and long term projects on contract. Please use the Contact Form for any enquiry.

More Posts - Website

Follow Me:
TwitterLinkedIn