I'm trying to wrap my head around a site-to-site VPN configuration using StrongSwan that will allow remote sites to connect to our AWS VPC. The catch is, the remote gateways will potentially be using the same subnet as the VPC and they will not be able to do any NATing on their end so that will all have to be done on the AWS gateway.
I've come across IKEV2 and StrongSwan's "virtual IP" support and I think, with a combination of IPTable rules, can be the solution to this issue. Although I have a few questions regarding this architecture which you can see in the following diagram. I've defined a special subnet in our VPC for mapped remote VPN devices, this is to ensure we have the space available since there will be a lot of autoscaling going on elsewhere in the VPC.
Eventually whatever architecture I choose will need to be able to support multiple remote sites that all connect to our VPC.
- First and foremost, does this architecture seem reasonable given the situation or is there a better way to accomplish this entirely?
Assuming the answer to question #1 is yes,
It will be easy enough to determine a virtual subnet such that it doesn't overlap with my VPC (10.0.0.0/16) or the remote site (10.0.0.0/16), say I manually choose 11.0.0.0/24. How do I keep track of who is who in the virtual pool? Are address simply mapped 1-to-1 for example, 10.0.0.15 -> 11.0.0.15? What is the best way to keep track of this mapping?
I like the idea of a special subnet "Mapped VPN Subnet" because I can keep track of my available space. However, in your opinion is this approach just making the topology overly complex? The other option would be to scrap that subnet and simply use the virtual ip pools.
Assuming the answer to question #3 is yes,
- What is the best way to implement NAT IPTable rules such that addressed in the virtual pool are PRE/POST routed to the "Mapped VPN Subnet". Something like this?
Rules,
iptables -t nat -A PREROUTING -d <virtual address> -j DNAT --to-destination <mapped vpc address>
iptables -t nat -A POSTROUTING -d <mapped vpc address> -j SNAT --to-source <virtual address>
After some basic testing, it looks like the mapping from remote subnet to virtual subnet is not 1-to-1. I also cannot seem to map the entire subnet instead only the remote gateway is being mapped.
Local Gateway Config
config setup
charonstart=yes
plutostart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
authby=secret
conn testConn
leftid=%any
left=10.0.0.11
leftsubnet=10.0.0.0/16
leftfirewall=yes
right=%any
rightsourceip=16.16.0.0/16
rightsubnet=10.0.0.0/16
auto=add
Remote Client Config
config setup
charonstart=yes
plutostart=no
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev2
authby=secret
conn testConn
left=%any
leftsourceip=%config
leftsubnet=10.0.0.0/16
leftid=%any
leftfirewall=yes
right=<Gateway Public IP>
rightsubnet=10.0.0.0/16
rightid=%any
auto=start
Charon Logs
charon: 04[IKE] peer requested virtual IP %any
charon: 04[CFG] assigning new lease to '10.0.0.10'
charon: 04[IKE] assigning virtual IP 16.16.0.1 to peer '10.0.0.10'
How the heck do I get the entire remote subnet to map into the virtual IP pool!?!?
