How to Create Site-to-Site VPN Connections on Amazon Web Service(AWS).

AWS Site-to-Site VPN creates encrypted tunnels between your network and your Amazon Virtual Private Clouds or AWS Transit Gateways. For managing remote access, AWS Client VPN connects your users to AWS or on-premises resources using a VPN software client.

A site-to-site virtual private network (VPN) is a connection between two or more networks, such as a corporate network and a branch office network. Many organizations use site-to-site VPNs to leverage an internet connection for private traffic as an alternative to using private MPLS circuits.

• Login to aws portal.
• Click on Services.

• Under Networking & Content Delivery select VPC.

• Click on Site-to-Site VPN connections.

• Click on Create VPN connection.

• Provide VPN Connection tag name.
• Select Target Gateway type: Virtual Private or Transit Gateway.So first click on link https://www.hackerxone.com/blog/how-virtual-private-gateway-amazon-web-serviceaws or https://www.hackerxone.com/blog/how-create-transit-gateway-amazon-web-serviceaws for how to create virtual private or transit gateway.
• Then select Virtual Private or Transit Gateway ID.
• Create or select existing Customer Gateway so click on link https://www.hackerxone.com/blog/how-create-customer-gateway-amazon-web-serviceaws for how to create Customer Gateway.
• Select Customer Gateway ID.
• Select Routing Options :Dynamic or Static
• Select Tunnel Inside IP version :IPv4 or IPv6

• Provide Local Or Remote IPv4 Network CIDR.Specify the IPv4 CIDR range on the AWS side that is allowed to communicate over the VPN tunnels.The default is 0.0.0.0/0.
• We can provide Tunnel information like IP address or pre-shared key.Otherwise leave the tunnel options.

• Click on Create VPN connection.

• VPN connection is created successfully.
• Click on Close.

• Go to vpn connection console page.
• New vpn connection is there with the name we provide.

Create Site-to-Site VPN connection using Shell

• Setup aws-cli on your system so click on link https://www.hackerxone.com/blog/how-install-configure-aws-cli-ubuntu-1804
• Run the following command:

To create a VPN connection with dynamic routing

aws ec2 create-vpn-connection –type ipsec.1 –customer-gateway-id cgw-id –vpn-gateway-id vgw-id –tag-specification ‘ResourceType=vpn-connection,Tags=[{Key=Name,Value=BGP-VPN}]’

To create a VPN connection with static routing

aws ec2 create-vpn-connection –type ipsec.1 –customer-gateway-id cgw-id –vpn-gateway-id vgw-id –options “{\”StaticRoutesOnly\”:true}”

To create a VPN connection and specify your own inside CIDR and pre-shared key

aws ec2 create-vpn-connection –type ipsec.1 –customer-gateway-id cgw-id –vpn-gateway-id vgw-id –options TunnelOptions='[{TunnelInsideCidr=ipv4-cidr,PreSharedKey=Pre-Shared-Key},{TunnelInsideCidr=ipv4-cidr,PreSharedKey=Pre-Shared-Key2}]’

To create a VPN connection that supports IPv6 traffic

aws ec2 create-vpn-connection –type ipsec.1 –transit-gateway-id tgw-id –customer-gateway-id cgw-id –options TunnelInsideIpVersion=ipv6,TunnelOptions=[{StartupAction=start},{StartupAction=start}]