AWS VPN如何连接[关闭]

Question

如何从 ubuntu 桌面连接到 AWS 实例 VPN？ 我已经配置了一个虚拟专用网关、一个客户网关和 VPN 连接。 安全组允许所有流量和 ACL 到。

这是我的 VPN 配置。

! Amazon Web Services
! Virtual Private Cloud

! AWS utilizes unique identifiers to manipulate the configuration of 
! a VPN Connection. Each VPN Connection is assigned an identifier and is 
! associated with two other identifiers, namely the 
! Customer Gateway Identifier and Virtual Private Gateway Identifier.
!
! Your VPN Connection ID          : vpn-c9562082
! Your Virtual Private Gateway ID         : vgw-e0704394
! Your Customer Gateway ID        : cgw-d73201a3
!
!
! This configuration consists of two tunnels. Both tunnels must be 
! configured on your Customer Gateway.
!
! --------------------------------------------------------------------------------
! IPSec Tunnel #1
! --------------------------------------------------------------------------------
! #1: Internet Key Exchange (IKE) Configuration
!
! A policy is established for the supported ISAKMP encryption, 
! authentication, Diffie-Hellman, lifetime, and key parameters.
!
! Note that there are a global list of ISAKMP policies, each identified by 
! sequence number. This policy is defined as #200, which may conflict with
! an existing policy using the same number. If so, we recommend changing 
! the sequence number to avoid conflicts.
!
crypto isakmp policy 200
  encryption aes 128
  authentication pre-share
  group 2
  lifetime 28800
  hash sha
exit

! The ISAKMP keyring stores the Pre Shared Key used to authenticate the 
! tunnel endpoints.
!
crypto keyring keyring-vpn-c9562082-0
  local-address 193.145.247.253
  pre-shared-key address 52.30.80.142 key YsTEH4xu5t2Z7F.QtkvXy4NsSJ9fRJe2
exit

! An ISAKMP profile is used to associate the keyring with the particular 
! endpoint.
!
crypto isakmp profile isakmp-vpn-c9562082-0
  local-address 193.145.247.253
  match identity address 52.30.80.142
  keyring keyring-vpn-c9562082-0
exit

! #2: IPSec Configuration
! 
! The IPSec transform set defines the encryption, authentication, and IPSec
! mode parameters.
!
crypto ipsec transform-set ipsec-prop-vpn-c9562082-0 esp-aes 128 esp-sha-hmac 
  mode tunnel
exit

! The IPSec profile references the IPSec transform set and further defines
! the Diffie-Hellman group and security association lifetime.
!
crypto ipsec profile ipsec-vpn-c9562082-0
  set pfs group2
  set security-association lifetime seconds 3600
  set transform-set ipsec-prop-vpn-c9562082-0
exit

! Additional parameters of the IPSec configuration are set here. Note that 
! these parameters are global and therefore impact other IPSec 
! associations.
! This option instructs the router to clear the "Don't Fragment" 
! bit from packets that carry this bit and yet must be fragmented, enabling
! them to be fragmented.
!
crypto ipsec df-bit clear

! This option enables IPSec Dead Peer Detection, which causes periodic
! messages to be sent to ensure a Security Association remains operational.
!
crypto isakmp keepalive 10 10 on-demand

! This configures the gateway's window for accepting out of order
! IPSec packets. A larger window can be helpful if too many packets 
! are dropped due to reordering while in transit between gateways.
!
crypto ipsec security-association replay window-size 128

! This option instructs the router to fragment the unencrypted packets
! (prior to encryption).
!
crypto ipsec fragmentation before-encryption


! --------------------------------------------------------------------------------
! #3: Tunnel Interface Configuration
!  
! A tunnel interface is configured to be the logical interface associated  
! with the tunnel. All traffic routed to the tunnel interface will be 
! encrypted and transmitted to the VPC. Similarly, traffic from the VPC
! will be logically received on this interface.
!
! Association with the IPSec security association is done through the 
! "tunnel protection" command.
!
! The address of the interface is configured with the setup for your 
! Customer Gateway.  If the address changes, the Customer Gateway and VPN 
! Connection must be recreated with Amazon VPC.
!
interface Tunnel1
  ip address 169.254.20.134 255.255.255.252
  ip virtual-reassembly
  tunnel source 193.145.247.253
  tunnel destination 52.30.80.142 
  tunnel mode ipsec ipv4
  tunnel protection ipsec profile ipsec-vpn-c9562082-0
  ! This option causes the router to reduce the Maximum Segment Size of
  ! TCP packets to prevent packet fragmentation.
  ip tcp adjust-mss 1387 
  no shutdown
exit

! --------------------------------------------------------------------------------

! #4: Border Gateway Protocol (BGP) Configuration
!                                                                                     
! BGP is used within the tunnel to exchange prefixes between the
! Virtual Private Gateway and your Customer Gateway. The Virtual Private Gateway    
! will announce the prefix corresponding to your VPC.
!            
! Your Customer Gateway may announce a default route (0.0.0.0/0), 
! which can be done with the 'network' and 'default-originate' statements.
!
! The BGP timers are adjusted to provide more rapid detection of outages.
!
! The local BGP Autonomous System Number (ASN) (65000) is configured
! as part of your Customer Gateway. If the ASN must be changed, the 
! Customer Gateway and VPN Connection will need to be recreated with AWS.
!
router bgp 65000
  neighbor 169.254.20.133 remote-as 9059
  neighbor 169.254.20.133 activate
  neighbor 169.254.20.133 timers 10 30 30
  address-family ipv4 unicast
    neighbor 169.254.20.133 remote-as 9059
    neighbor 169.254.20.133 timers 10 30 30
    neighbor 169.254.20.133 default-originate
    neighbor 169.254.20.133 activate
    neighbor 169.254.20.133 soft-reconfiguration inbound
! To advertise additional prefixes to Amazon VPC, copy the 'network' statement 
! and identify the prefix you wish to advertise. Make sure the prefix is present 
! in the routing table of the device with a valid next-hop.
    network 0.0.0.0
  exit
exit
!
! --------------------------------------------------------------------------------
! IPSec Tunnel #2
! --------------------------------------------------------------------------------
! #1: Internet Key Exchange (IKE) Configuration
!
! A policy is established for the supported ISAKMP encryption, 
! authentication, Diffie-Hellman, lifetime, and key parameters.
!
! Note that there are a global list of ISAKMP policies, each identified by 
! sequence number. This policy is defined as #201, which may conflict with
! an existing policy using the same number. If so, we recommend changing 
! the sequence number to avoid conflicts.
!
crypto isakmp policy 201
  encryption aes 128
  authentication pre-share
  group 2
  lifetime 28800
  hash sha
exit

! The ISAKMP keyring stores the Pre Shared Key used to authenticate the 
! tunnel endpoints.
!
crypto keyring keyring-vpn-c9562082-1
  local-address 193.145.247.253
  pre-shared-key address 52.30.118.25 key 5_KiSCRDEgIebtEdblX3Bu7k.QnPQYnf
exit

! An ISAKMP profile is used to associate the keyring with the particular 
! endpoint.
!
crypto isakmp profile isakmp-vpn-c9562082-1
  local-address 193.145.247.253
  match identity address 52.30.118.25
  keyring keyring-vpn-c9562082-1
exit

! #2: IPSec Configuration
! 
! The IPSec transform set defines the encryption, authentication, and IPSec
! mode parameters.
!
crypto ipsec transform-set ipsec-prop-vpn-c9562082-1 esp-aes 128 esp-sha-hmac 
  mode tunnel
exit

! The IPSec profile references the IPSec transform set and further defines
! the Diffie-Hellman group and security association lifetime.
!
crypto ipsec profile ipsec-vpn-c9562082-1
  set pfs group2
  set security-association lifetime seconds 3600
  set transform-set ipsec-prop-vpn-c9562082-1
exit

! Additional parameters of the IPSec configuration are set here. Note that 
! these parameters are global and therefore impact other IPSec 
! associations.
! This option instructs the router to clear the "Don't Fragment" 
! bit from packets that carry this bit and yet must be fragmented, enabling
! them to be fragmented.
!
crypto ipsec df-bit clear

! This option enables IPSec Dead Peer Detection, which causes periodic
! messages to be sent to ensure a Security Association remains operational.
!
crypto isakmp keepalive 10 10 on-demand

! This configures the gateway's window for accepting out of order
! IPSec packets. A larger window can be helpful if too many packets 
! are dropped due to reordering while in transit between gateways.
!
crypto ipsec security-association replay window-size 128

! This option instructs the router to fragment the unencrypted packets
! (prior to encryption).
!
crypto ipsec fragmentation before-encryption


! --------------------------------------------------------------------------------
! #3: Tunnel Interface Configuration
!  
! A tunnel interface is configured to be the logical interface associated  
! with the tunnel. All traffic routed to the tunnel interface will be 
! encrypted and transmitted to the VPC. Similarly, traffic from the VPC
! will be logically received on this interface.
!
! Association with the IPSec security association is done through the 
! "tunnel protection" command.
!
! The address of the interface is configured with the setup for your 
! Customer Gateway.  If the address changes, the Customer Gateway and VPN 
! Connection must be recreated with Amazon VPC.
!
interface Tunnel2
  ip address 169.254.20.226 255.255.255.252
  ip virtual-reassembly
  tunnel source 193.145.247.253
  tunnel destination 52.30.118.25 
  tunnel mode ipsec ipv4
  tunnel protection ipsec profile ipsec-vpn-c9562082-1
  ! This option causes the router to reduce the Maximum Segment Size of
  ! TCP packets to prevent packet fragmentation.
  ip tcp adjust-mss 1387 
  no shutdown
exit

! --------------------------------------------------------------------------------

! #4: Border Gateway Protocol (BGP) Configuration
!                                                                                     
! BGP is used within the tunnel to exchange prefixes between the
! Virtual Private Gateway and your Customer Gateway. The Virtual Private Gateway    
! will announce the prefix corresponding to your VPC.
!            
! Your Customer Gateway may announce a default route (0.0.0.0/0), 
! which can be done with the 'network' and 'default-originate' statements.
!
! The BGP timers are adjusted to provide more rapid detection of outages.
!
! The local BGP Autonomous System Number (ASN) (65000) is configured
! as part of your Customer Gateway. If the ASN must be changed, the 
! Customer Gateway and VPN Connection will need to be recreated with AWS.
!
router bgp 65000
  neighbor 169.254.20.225 remote-as 9059
  neighbor 169.254.20.225 activate
  neighbor 169.254.20.225 timers 10 30 30
  address-family ipv4 unicast
    neighbor 169.254.20.225 remote-as 9059
    neighbor 169.254.20.225 timers 10 30 30
    neighbor 169.254.20.225 default-originate
    neighbor 169.254.20.225 activate
    neighbor 169.254.20.225 soft-reconfiguration inbound
! To advertise additional prefixes to Amazon VPC, copy the 'network' statement 
! and identify the prefix you wish to advertise. Make sure the prefix is present 
! in the routing table of the device with a valid next-hop.
    network 0.0.0.0
  exit
exit
!


! Additional Notes and Questions
!  - Amazon Virtual Private Cloud Getting Started Guide: 
!       http://docs.amazonwebservices.com/AmazonVPC/latest/GettingStartedGuide
!  - Amazon Virtual Private Cloud Network Administrator Guide: 
!       http://docs.amazonwebservices.com/AmazonVPC/latest/NetworkAdminGuide
!  - XSL Version: 2009-07-15-1119716

Answer 1

Amazon VPC 提供的标准 VPN 连接不是为偶尔连接而设计的。这是一个永久的连接。

首先，值得一提的是 VPC 可以连接到现有（“本地”）网络的方式：

• Direct Connect：现有数据中心和 AWS 之间的光纤连接
• 通过虚拟专用网关 (VGW) 的 VPN 连接： 现有数据中心的本地网络路由器与 Amazon VPC（连接到 VGW）之间的永久连接。这需要一个永久配置的本地路由器，并且不是为临时连接而设计的。提供了两条 IPSEC 隧道以实现冗余，每条都终止于 AWS 内的不同设备上。
• 临时（拨入）VPN 连接：用于偶尔连接，类似于使用 securID 令牌连接到工作场所网络时

您似乎正在尝试从您的 ubuntu 桌面到 VGW 建立临时连接。这不是 VPN 连接的预期用途。

相反，您应该使用在您的 VPC 内的实例上运行的软件 VPN 解决方案（例如 OpenSwan、OpenVPN）。

一些相关文章：

• Connecting Multiple VPCs with EC2 Instances (IPSec)
• Site-to-Site VPN between AWS VPC and Customer Site using Linux
• Setting Up IPSEC/OpenSwan in Amazon EC2

Answer 2

确保您的安全组配置和网络 ACL 允许通过端口 22 进行入站连接。

关于这里的更多信息： http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html