AWS VPN to Azure VM with Libreswan

NOTE: As of this article AWS Site to Site VPN gateway can generate an Openswan configuration but not Libreswan. This is a test to use Libreswan.

Using an Azure Virtual Machine on the left and AWS VPN gateway on the right but of course can also use Azure VPN service

For reference OCI to Libreswan from a while back

Setup right side in AWS Console

Create Customer Gateway > azure-gw01 using Static Routing and specify Azure VM IP Address - Create Virtual Private Gateway az-vpg01 Amazon default ASN
Attach VPG to VPC
For Site-to-Site VPN
Create VPN Connection > iqonda-aws-azure pick VPG and CG Routing Static leave all defaults for now and no Static IP Prefixes for the moment
Record Tunnel1 IP Address

Setup left side in Azure

Create a Centos VM in Azure

Virtual machines > Add
| test01 | CentOS-based 8.1 | Standard_B1ls 1 vcpu, 0.5 GiB memory ($3.80/month) | AzureUser
* I used a password for AzureUser and sort out SSH keys after logged in.
I used | Standard HDD | myVnet | mySubnet(10.0.0.0/24)
record public IP
Network add inbound rules for ipsec. I did an all traffic for the AWS endpoint IP address but you want to be more specific on ipsec ports.

software

1
# cat /etc/centos-release
2
CentOS Linux release 8.1.1911 (Core)
3

4
# yum install libreswan
5

6
# echo "net.ipv4.ip_forward=1" > /usr/lib/sysctl.d/60-ipsec.conf
7
# sysctl -p /usr/lib/sysctl.d/60-ipsec.conf
8
net.ipv4.ip_forward = 1
9

10
# for s in /proc/sys/net/ipv4/conf/*; do echo 0 > $s/send_redirects; echo 0 > $s/accept_redirects; done
11

12
# echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
13

14
# ipsec verify
15
Verifying installed system and configuration files
16

17
Version check and ipsec on-path                     [OK]
18
Libreswan 3.29 (netkey) on 4.18.0-147.8.1.el8_1.x86_64
19
Checking for IPsec support in kernel                [OK]
20
 NETKEY: Testing XFRM related proc values
21
         ICMP default/send_redirects                [OK]
22
         ICMP default/accept_redirects              [OK]
23
         XFRM larval drop                           [OK]
24
Pluto ipsec.conf syntax                             [OK]
25
Checking rp_filter                                  [OK]
26
Checking that pluto is running                      [OK]
27
 Pluto listening for IKE on udp 500                 [OK]
28
 Pluto listening for IKE/NAT-T on udp 4500          [OK]
29
 Pluto ipsec.secret syntax                          [OK]
30
Checking 'ip' command                               [OK]
31
Checking 'iptables' command                         [OK]
32
Checking 'prelink' command does not interfere with FIPS [OK]
33
Checking for obsolete ipsec.conf options            [OK]

NOTE: skipping firewalld and rules. this instance did not have firewalld enabled and iptables -L is open.

Download openswan config in AWS console to see the PSK

I had issues bringing the tunnel up but after reboot it works

post tunnel UP

add static route(s) to VPN
check route table for subnet
enable subnet association to route table
enable route propagation

ping test both ways works…

source

1
[root@test01 ipsec.d]# cat aws-az-vpn.conf
2
conn Tunnel1
3
        authby=secret
4
        auto=start
5
        encapsulation=yes
6
        left=%defaultroute
7
        leftid=[Azure VM IP]
8
        right=[AWS VPN Tunnel 1 IP]
9
        type=tunnel
10
        phase2alg=aes128-sha1;modp1024
11
        ike=aes128-sha1;modp1024
12
        leftsubnet=10.0.1.0/16
13
        rightsubnet=172.31.0.0/16
14

15
conn Tunnel2
16
        authby=secret
17
        auto=add
18
        encapsulation=yes
19
        left=%defaultroute
20
        leftid=[Azure VM IP]
21
        right=[AWS VPN Tunnel 2 IP]
22
        type=tunnel
23
        phase2alg=aes128-sha1;modp1024
24
        ike=aes128-sha1;modp1024
25
        leftsubnet=10.0.1.0/16
26
        rightsubnet=172.31.0.0/16
27

28
[root@test01 ipsec.d]# cat aws-az-vpn.secrets
29
52.188.118.56 18.214.218.99: PSK "Qgn...............mn"
30
52.188.118.56 52.3.140.122: PSK "cWu..................87"

Tunnel switch

Although Libreswan can’t manage two tunnels to the same right side without something like Quagga at least I did a very quick and dirty switchover script. It works and very minimal pings missed.

1
[root@test01 ~]# cat switch-aws-tunnel.sh
2
#!/bin/bash
3
echo "Current Tunnel Status"
4
ipsec status | grep routed
5

6
active=$(ipsec status | grep erouted | cut -d \" -f2)
7
inactive=$(ipsec status | grep unrouted | cut -d \" -f2)
8

9
echo "Showing active and inactive in tunnels"
10
echo "active: $active"
11
echo "inactive: $inactive"
12

13
echo "down tunnels...."
14
ipsec auto --down $active
15
ipsec auto --down $inactive
16

17
echo "adding tunnels...."
18
ipsec auto --add Tunnel1
19
ipsec auto --add Tunnel2
20

21
echo "up the tunnel that was inactive before...."
22
ipsec auto --up $inactive
23

24
echo "Current Tunnel Status"
25
ipsec status | grep routed

AWS VPN to Libreswan