Been porting workloads from AWS to GCE lately and one big piece of infrastructure that I rely on is pfSense.
pfSense is a FreeBSD based appliance which does advanced routing, firewall and VPN for your cloud-based infrastructure. Using pfSense, one can establish IPSEC tunnels between the various AWS regions and the clients office network. While pfSense is available from the AWS Marketplace, it’s currently not yet available on Google Cloud.
StrongSwan is a viable replacement for environments where pfSense is not an option. Below is a working “site to site” StrongSwan configuration running on Ubuntu 14.04 LTS GCE instance and works with pfSense 2.2. Please note that pfSense 2.2 has moved from racoon to StrongSwan.
# apt-get install strongswan conn myconn reqid = 1 fragmentation = yes keyexchange = ikev1 reauth = yes forceencaps = no rekey = yes installpolicy = yes type = tunnel dpdaction=restart dpddelay = 10s dpdtimeout = 60s auto = route left = 10.240.x.x # my private IP as assigned to eth0 on GCE instance right = 103.x.x.x # the site I am connecting to leftid = 1.2.3.4 # my GCE ephemeral / static IP ikelifetime = 28800s lifetime = 3600s ike = aes256-sha1-modp1024! esp = aes256-sha1! leftauth = psk rightauth = psk rightid = 103.x.x.x # the site I am connecting to aggressive = no rightsubnet = 192.168.x.0/24 # my office private subnet leftsubnet = 10.240.0.0/16 # my GCE private network
