Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a requirement to secure all communications between our Linux instances on Amazon EC2 - we need to treat the EC2 network as compromised and therefore want to protect the data that's being transferred within the EC2 subnet(s). The instances to secure will all be on the same subnet. I'm a Windows bod with limited Linux abilities, so am familiar with IPSec terminology and can find my way around Linux, but haven't got a clue when it comes to setting up Linux IPSec environments.

Can anyone throw me some information for setting up IPSec between all (Linux) hosts on a subnet please? I can only find information that pertains to site-to-site connections, or host-to-host connections and nothing that covers all Lan communication. We're currently using OpenSwan for site-to-site VPNs if that helps.

Updated with more information

This is an example config (very basic to connect between two hosts using a pre-shared key):

    conn test

If I now want to secure all traffic between 4 hosts for instance (or 8,10,100 etc), is there a way to make the left and right parameters more generic, so they mean 'encrypt traffic between all hosts' rather than having to explicitly specify a left and right host.

My goal would be to achieve a generic configuration that has no hardcoded host IP's (subnets would be OK), so that we could include the configuration in our EC2 image.

Thanks Mick

share|improve this question
You should not be on EC2 at all. If you can't trust Amazon's private network, you certainly can't trust their storage or servers either. Move in-house on a private cloud. – Michael Hampton Mar 13 '14 at 13:25
Yep, you're correct, which is why we are already using other third party solutions to mitigate those risks. Amazon's network is likely fairly secure, but as in any industry, a malicious person inside the company with access to the various networks may choose to capture data. We take many of the same steps for our internal services. – MJM Mar 16 '14 at 7:52

The short story, yes, there should not be any problem to run tunnels between hosts on a subnet and instead of adding routes to networks behind endpoints you would have to add host routes (/32) instead.

A generic guide on how to set up a site to site tunnel could be of use: Building a site-to-site VPN with Debian/Ubuntu and Openswan

I would personally use OpenVPN because of it's much simpler nature but if IPSec is required you will have to use OpenSwan.

share|improve this answer
Thanks. I've updated the question in response to your reply. Having to explicitly specify a host for the left and right parameters won't scale, and i'm asusming the host routes you mention need to go into the leftsubnet/rightsubnet parameters - what would need to go into the left/right parameters? – MJM Mar 16 '14 at 8:03
Host-To-Host VPN Using Openswan details how to accomplish host-to-host tunnels. You are referring to mesh-tunneling which I'm not sure of how to achieve. – mingalsuo Apr 9 '14 at 10:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.