Question

如何从ubuntu桌面连接到AWS实例VPN？我已经配置了虚拟专用网关，客户网关和VPN连接。安全组允许所有流量和ACL。

这是我的VPN配置。

! Amazon Web Services
! Virtual Private Cloud

! AWS utilizes unique identifiers to manipulate the configuration of 
! a VPN Connection. Each VPN Connection is assigned an identifier and is 
! associated with two other identifiers, namely the 
! Customer Gateway Identifier and Virtual Private Gateway Identifier.
!
! Your VPN Connection ID          : vpn-c9562082
! Your Virtual Private Gateway ID         : vgw-e0704394
! Your Customer Gateway ID        : cgw-d73201a3
!
!
! This configuration consists of two tunnels. Both tunnels must be 
! configured on your Customer Gateway.
!
! --------------------------------------------------------------------------------
! IPSec Tunnel #1
! --------------------------------------------------------------------------------
! #1: Internet Key Exchange (IKE) Configuration
!
! A policy is established for the supported ISAKMP encryption, 
! authentication, Diffie-Hellman, lifetime, and key parameters.
!
! Note that there are a global list of ISAKMP policies, each identified by 
! sequence number. This policy is defined as #200, which may conflict with
! an existing policy using the same number. If so, we recommend changing 
! the sequence number to avoid conflicts.
!
crypto isakmp policy 200
  encryption aes 128
  authentication pre-share
  group 2
  lifetime 28800
  hash sha
exit

! The ISAKMP keyring stores the Pre Shared Key used to authenticate the 
! tunnel endpoints.
!
crypto keyring keyring-vpn-c9562082-0
  local-address 193.145.247.253
  pre-shared-key address 52.30.80.142 key YsTEH4xu5t2Z7F.QtkvXy4NsSJ9fRJe2
exit

! An ISAKMP profile is used to associate the keyring with the particular 
! endpoint.
!
crypto isakmp profile isakmp-vpn-c9562082-0
  local-address 193.145.247.253
  match identity address 52.30.80.142
  keyring keyring-vpn-c9562082-0
exit

! #2: IPSec Configuration
! 
! The IPSec transform set defines the encryption, authentication, and IPSec
! mode parameters.
!
crypto ipsec transform-set ipsec-prop-vpn-c9562082-0 esp-aes 128 esp-sha-hmac 
  mode tunnel
exit

! The IPSec profile references the IPSec transform set and further defines
! the Diffie-Hellman group and security association lifetime.
!
crypto ipsec profile ipsec-vpn-c9562082-0
  set pfs group2
  set security-association lifetime seconds 3600
  set transform-set ipsec-prop-vpn-c9562082-0
exit

! Additional parameters of the IPSec configuration are set here. Note that 
! these parameters are global and therefore impact other IPSec 
! associations.
! This option instructs the router to clear the "Don't Fragment" 
! bit from packets that carry this bit and yet must be fragmented, enabling
! them to be fragmented.
!
crypto ipsec df-bit clear

! This option enables IPSec Dead Peer Detection, which causes periodic
! messages to be sent to ensure a Security Association remains operational.
!
crypto isakmp keepalive 10 10 on-demand

! This configures the gateway's window for accepting out of order
! IPSec packets. A larger window can be helpful if too many packets 
! are dropped due to reordering while in transit between gateways.
!
crypto ipsec security-association replay window-size 128

! This option instructs the router to fragment the unencrypted packets
! (prior to encryption).
!
crypto ipsec fragmentation before-encryption


! --------------------------------------------------------------------------------
! #3: Tunnel Interface Configuration
!  
! A tunnel interface is configured to be the logical interface associated  
! with the tunnel. All traffic routed to the tunnel interface will be 
! encrypted and transmitted to the VPC. Similarly, traffic from the VPC
! will be logically received on this interface.
!
! Association with the IPSec security association is done through the 
! "tunnel protection" command.
!
! The address of the interface is configured with the setup for your 
! Customer Gateway.  If the address changes, the Customer Gateway and VPN 
! Connection must be recreated with Amazon VPC.
!
interface Tunnel1
  ip address 169.254.20.134 255.255.255.252
  ip virtual-reassembly
  tunnel source 193.145.247.253
  tunnel destination 52.30.80.142 
  tunnel mode ipsec ipv4
  tunnel protection ipsec profile ipsec-vpn-c9562082-0
  ! This option causes the router to reduce the Maximum Segment Size of
  ! TCP packets to prevent packet fragmentation.
  ip tcp adjust-mss 1387 
  no shutdown
exit

! --------------------------------------------------------------------------------

! #4: Border Gateway Protocol (BGP) Configuration
!                                                                                     
! BGP is used within the tunnel to exchange prefixes between the
! Virtual Private Gateway and your Customer Gateway. The Virtual Private Gateway    
! will announce the prefix corresponding to your VPC.
!            
! Your Customer Gateway may announce a default route (0.0.0.0/0), 
! which can be done with the 'network' and 'default-originate' statements.
!
! The BGP timers are adjusted to provide more rapid detection of outages.
!
! The local BGP Autonomous System Number (ASN) (65000) is configured
! as part of your Customer Gateway. If the ASN must be changed, the 
! Customer Gateway and VPN Connection will need to be recreated with AWS.
!
router bgp 65000
  neighbor 169.254.20.133 remote-as 9059
  neighbor 169.254.20.133 activate
  neighbor 169.254.20.133 timers 10 30 30
  address-family ipv4 unicast
    neighbor 169.254.20.133 remote-as 9059
    neighbor 169.254.20.133 timers 10 30 30
    neighbor 169.254.20.133 default-originate
    neighbor 169.254.20.133 activate
    neighbor 169.254.20.133 soft-reconfiguration inbound
! To advertise additional prefixes to Amazon VPC, copy the 'network' statement 
! and identify the prefix you wish to advertise. Make sure the prefix is present 
! in the routing table of the device with a valid next-hop.
    network 0.0.0.0
  exit
exit
!
! --------------------------------------------------------------------------------
! IPSec Tunnel #2
! --------------------------------------------------------------------------------
! #1: Internet Key Exchange (IKE) Configuration
!
! A policy is established for the supported ISAKMP encryption, 
! authentication, Diffie-Hellman, lifetime, and key parameters.
!
! Note that there are a global list of ISAKMP policies, each identified by 
! sequence number. This policy is defined as #201, which may conflict with
! an existing policy using the same number. If so, we recommend changing 
! the sequence number to avoid conflicts.
!
crypto isakmp policy 201
  encryption aes 128
  authentication pre-share
  group 2
  lifetime 28800
  hash sha
exit

! The ISAKMP keyring stores the Pre Shared Key used to authenticate the 
! tunnel endpoints.
!
crypto keyring keyring-vpn-c9562082-1
  local-address 193.145.247.253
  pre-shared-key address 52.30.118.25 key 5_KiSCRDEgIebtEdblX3Bu7k.QnPQYnf
exit

! An ISAKMP profile is used to associate the keyring with the particular 
! endpoint.
!
crypto isakmp profile isakmp-vpn-c9562082-1
  local-address 193.145.247.253
  match identity address 52.30.118.25
  keyring keyring-vpn-c9562082-1
exit

! #2: IPSec Configuration
! 
! The IPSec transform set defines the encryption, authentication, and IPSec
! mode parameters.
!
crypto ipsec transform-set ipsec-prop-vpn-c9562082-1 esp-aes 128 esp-sha-hmac 
  mode tunnel
exit

! The IPSec profile references the IPSec transform set and further defines
! the Diffie-Hellman group and security association lifetime.
!
crypto ipsec profile ipsec-vpn-c9562082-1
  set pfs group2
  set security-association lifetime seconds 3600
  set transform-set ipsec-prop-vpn-c9562082-1
exit

! Additional parameters of the IPSec configuration are set here. Note that 
! these parameters are global and therefore impact other IPSec 
! associations.
! This option instructs the router to clear the "Don't Fragment" 
! bit from packets that carry this bit and yet must be fragmented, enabling
! them to be fragmented.
!
crypto ipsec df-bit clear

! This option enables IPSec Dead Peer Detection, which causes periodic
! messages to be sent to ensure a Security Association remains operational.
!
crypto isakmp keepalive 10 10 on-demand

! This configures the gateway's window for accepting out of order
! IPSec packets. A larger window can be helpful if too many packets 
! are dropped due to reordering while in transit between gateways.
!
crypto ipsec security-association replay window-size 128

! This option instructs the router to fragment the unencrypted packets
! (prior to encryption).
!
crypto ipsec fragmentation before-encryption


! --------------------------------------------------------------------------------
! #3: Tunnel Interface Configuration
!  
! A tunnel interface is configured to be the logical interface associated  
! with the tunnel. All traffic routed to the tunnel interface will be 
! encrypted and transmitted to the VPC. Similarly, traffic from the VPC
! will be logically received on this interface.
!
! Association with the IPSec security association is done through the 
! "tunnel protection" command.
!
! The address of the interface is configured with the setup for your 
! Customer Gateway.  If the address changes, the Customer Gateway and VPN 
! Connection must be recreated with Amazon VPC.
!
interface Tunnel2
  ip address 169.254.20.226 255.255.255.252
  ip virtual-reassembly
  tunnel source 193.145.247.253
  tunnel destination 52.30.118.25 
  tunnel mode ipsec ipv4
  tunnel protection ipsec profile ipsec-vpn-c9562082-1
  ! This option causes the router to reduce the Maximum Segment Size of
  ! TCP packets to prevent packet fragmentation.
  ip tcp adjust-mss 1387 
  no shutdown
exit

! --------------------------------------------------------------------------------

! #4: Border Gateway Protocol (BGP) Configuration
!                                                                                     
! BGP is used within the tunnel to exchange prefixes between the
! Virtual Private Gateway and your Customer Gateway. The Virtual Private Gateway    
! will announce the prefix corresponding to your VPC.
!            
! Your Customer Gateway may announce a default route (0.0.0.0/0), 
! which can be done with the 'network' and 'default-originate' statements.
!
! The BGP timers are adjusted to provide more rapid detection of outages.
!
! The local BGP Autonomous System Number (ASN) (65000) is configured
! as part of your Customer Gateway. If the ASN must be changed, the 
! Customer Gateway and VPN Connection will need to be recreated with AWS.
!
router bgp 65000
  neighbor 169.254.20.225 remote-as 9059
  neighbor 169.254.20.225 activate
  neighbor 169.254.20.225 timers 10 30 30
  address-family ipv4 unicast
    neighbor 169.254.20.225 remote-as 9059
    neighbor 169.254.20.225 timers 10 30 30
    neighbor 169.254.20.225 default-originate
    neighbor 169.254.20.225 activate
    neighbor 169.254.20.225 soft-reconfiguration inbound
! To advertise additional prefixes to Amazon VPC, copy the 'network' statement 
! and identify the prefix you wish to advertise. Make sure the prefix is present 
! in the routing table of the device with a valid next-hop.
    network 0.0.0.0
  exit
exit
!


! Additional Notes and Questions
!  - Amazon Virtual Private Cloud Getting Started Guide: 
!       http://docs.amazonwebservices.com/AmazonVPC/latest/GettingStartedGuide
!  - Amazon Virtual Private Cloud Network Administrator Guide: 
!       http://docs.amazonwebservices.com/AmazonVPC/latest/NetworkAdminGuide
!  - XSL Version: 2009-07-15-1119716

Answer 1

Amazon VPC提供的标准VPN连接不是为偶尔连接而设计的。它意味着永久的联系。

首先，值得一提的是VPC可以连接到现有网络（＆＃39;内部网络）的方式：

直接连接：现有数据中心与AWS之间的光纤连接
通过虚拟专用网关（VGW）建立VPN连接：现有数据中心内部网络路由器与Amazon VPC（连接到VGW）之间的永久连接。这需要永久配置的内部部署路由器，不适用于临时连接。提供两个IPSEC隧道用于冗余，每个隧道终止于AWS内的单独设备。
临时（拨入）VPN连接：用于偶尔连接，类似于使用securID令牌连接到工作区网络时

您似乎正在尝试从ubuntu桌面到VGW建立临时连接。这是不是VPN连接的预期用途。

相反，您应该使用在您的VPC中的实例上运行的软件VPN解决方案（例如OpenSwan，OpenVPN）。

一些相关文章：

Answer 2

确保您的安全组配置和网络ACL允许通过端口22进行入站连接。

有关此处的更多信息： http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html

AWS VPN如何连接

2 个答案: