IPSec Tunnel to Amazon EC2 - Netkey, NAT, and routing problem

Question

Hey all, I'm working on getting an IPSec VPN working between Amazon EC2 and my on-premise. The goal is to be able to safely administer stuff, up/download data, etc. over that tunnel.

I have gotten the tunnel up in openswan between a Fedora 12 instance with an elastic IP and a Cisco router that's also NATted. I think the ipsec part is OK, but I'm having trouble figuring out how to route traffic that way; there's no "ipsec0" virutal interface because on Amazon you have to use netkey and not KLIPS for the vpn. I hear iptables may be required and I'm an iptables noob.

On the left (Amazon), I have a 10. network. Box 1 is privately 10.254.110.A, publically IP 184.73.168.B. Netkey tunnel is up. Box 2 is publically 130.164.26.C, privately 130.164.0.D

And my .conf is: conn ni type= tunnel authby= secret left= 10.254.110.A leftid= 184.73.168.B leftnexthop= %defaultroute leftsubnet= 10.254.0.0/32 right= 130.164.26.C rightid= 130.164.0.D rightnexthop= %defaultroute rightsubnet= 130.164.0.0/18 keyexchange= ike pfs= no auto= start keyingtries= 3 disablearrivalcheck=no ikelifetime= 240m auth= esp compress= no keylife= 60m forceencaps= yes esp= 3des-md5

I added a route to box 1 (130.164.0.0/18 via 10.254.110.A dev eth0) but that doesn't do it for predictable reasons, when I traceroute the traffic's still going "around" and not through the vpn.

Routing table: 10.254.110.0/23 dev eth0 proto kernel scope link src 10.254.110.A 130.164.0.0/18 via 10.254.110.178 dev eth0 src 10.254.110.A 169.254.0.0/16 dev eth0 scope link metric 1002

Anyone know how to do the routing with a netkey ipsec tunnel where both sides are NATted?

Thanks...

Answer 1

You know about Amazon Virtual Private Cloud, right?

I spent weeks working on a scheme of OpenVPN and fancy routing to accomplish the same thing, after which Amazon released this service and obsoleted my work.

Answer 2

Ernest, did you ever get a resolution to this? I have set up something similar, and I can get traffic to route from our network (say 10.10.10.0/24) TO the VPN instance (in this case I'm using openswan and IPSec), but because we don't control the routers we can't add the off-wire routes on the Amazon side. I would imagine IF another instance happened to come up on the same private network as my VPN (say 10.100.100.0/24), it would be easy enough to add a route to the instance pointing to the VPN - but the problem arises when the instance comes up on another network (say 10.200.200.0/24). Even when our security rules allow these instances to "see" each other in the cloud, there's not a way to add the off-wire route back to the VPN server for the 10.10.10.0/24 network, since the VPN isn't on the same network.

Answer 3

May I suggest you have a look at vCider? It allows you to create secure, virtual networks even across provider boundaries (in case you want to expand beyond EC2). You can create your own provider-independent VPC. It also offers you to 'cloak' your cloud network: Basically, you can make your cloud nodes disappear from the public network, but you can specify exceptions for individual nodes. It offers specific features to connect your enterprise network to the cloud portion of the network.

Disclaimer: I work for vCider. But please don't let this stop you from having a look at it. You can create virtual private networks for up to 8 hosts for free.