Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to setup an IPSec connection between my linux machine and a linux Ec2 instance?

I can see the public IP address of EC2 but there is no interface listed in the instance associated with that IP (there is only eth0 with some 10.x.x.x private IP).

Anyway I tried to setup ipsec with the public ip and it is not working.

share|improve this question
"I tried to setup ipsec" what exactly did you try? – Antonius Bloch Apr 18 '11 at 5:53
I used setkey and racoon. I used my ip and the public ip of ec2 instance. – bonzi Apr 18 '11 at 7:29

Take a look at openswan with nat trasversal through to the public IP. you use a fake 192 address as the endpoint on the server and do nat pre and post routing to fake it back to your 10. address which will then be natted to your routable by amazon. Works well for machine to machine or when setting up a site to site out to hardware firewalls.

share|improve this answer
Can I do it with ipsec-tools? – bonzi May 19 '11 at 11:58

If you can accept a commercial software solution, I recommend using Vyatta in AWS. It has a great JUNOS-like CLI and a GUI. Configuring IPsec using Vyatta is much easier than configuring OpenSwan.

Note that AWS public IPs are always NAT'ed. You'll need to connect to a non-NAT'ed end point outside of AWS. Use NAT traversal and force the AWS tunnel end point initiate the tunnel.

See for more information on the Vyatta AMI.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.