Setting Up a Raspberry Pi 3 as an AWS VPN Customer Gateway

In my previous article, I showed you how to use a VPN software solution like OpenVPN to create a secure tunnel to your AWS private resources. In this post, I will walk you through step by step to set up a secure bridge to your remote AWS VPC subnets from your home network with a Raspberry Pi as a Customer Gateway.

To get started, find your home router's public-facing IP address:

Next, sign into the AWS Management Console, navigate to the VPC dashboard and create a new VPN Customer Gateway:

Next, create a Virtual Private Gateway:

And attach it to the target VPC:

Then, create a VPN Connection with the Customer Gateway and the Virtual Private Gateway:

Note: Make sure to add your home CIDR subnet to the Static IP Prefixes section.

Once the VPN Connection is created, click on the “Tunnel Details” tab. You should see two tunnels for redundancy:

It may take a few minutes to create the VPN connection. When it’s ready, select the connection and choose "Download Configuration." Then, open the configuration file and write down your pre-shared-key and tunnel IP:

tunnel-group 52.47.119.151 type ipsec-l2l
tunnel-group 52.47.119.151 ipsec-attributes
   pre-shared-key irCAIDE1NFxyOiE4w49ijHfPMjTW9rL6

I used a Raspberry Pi 3 (Quad Core CPU 1.2 GHz, 1 GB RAM) with Raspbian, with SSH server enabled (default username & password: pi/raspberry). You can log in and start manipulating the Pi:

IPsec kernel support must be installed. Therefore, you must install openswan on your Pi:

sudo apt-get install -y openswan lsof

Update the /etc/ipsec.conf file as below:

version 2.0     # conforms to second version of ipsec.conf specification

# basic configuration
config setup
        # Enable core dumps (might require system changes, like ulimit -C)
        dumpdir=/var/run/pluto/
        # NAT-TRAVERSAL support, see README.NAT-Traversal
        nat_traversal=yes
        virtual_private=
        # OE is now off by default. Uncomment and change to on, to enable.
        oe=off
        # which IPsec stack to use. auto will try netkey, then klips then mast
        protostack=netkey

include /etc/ipsec.d/*.conf

Create a new IPsec Connection in /etc/ipsec.d/home-to-aws.conf :

conn home-to-aws
 type=tunnel
 authby=secret
 #left=%defaultroute
 left=192.168.1.81
 leftid=89.95.X.Y
 leftnexthop=%defaultroute
 leftsubnet=192.168.0.0/16
 right=52.47.119.151
 rightsubnet=10.0.0.0/16
 pfs=yes
 auto=start

• left: Your Raspberry Pi private IP.
• leftid: Your home router public-facing IP.
• leftsubnet: CIDR of your home subnet.
• right: Virtual Private Gateway tunnel IP.
• rightsubnet: CIDR of your VPC.

Add the tunnel pre-shared key to /var/lib/openswan/ipsec.secrets.inc:

89.95.X.Y 52.47.119.151 : PSK "irCAIDE1NFxyOiE4w49ijHfPMjTW9rL6"

To enable the IPv4 forwarding, edit /etc/sysctl.conf, and ensure the following lines are uncommented:

net.ipv4.ip_forward=1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

Run sysctl -p to reload it. Then, restart IPsec:

service ipsec restart

Verify if the service is running correctly:

If you go back to your AWS Dashboard, you should see the 1st tunnel status changed to UP:

Add a new route entry that forwards traffic to your home subnet through the VPN Gateway:

Note: Follow the same steps above to set up the 2nd tunnel for resiliency and high availability of VPN connectivity.

Launch an EC2 instance in the private subnet to verify the VPN connection:

Allow SSH only from your home gateway CIDR:

Connect via SSH using the instance private IP address:

Congratulations! You can now connect securely to your private EC2 instances.

To take it further and connect from other machines in the same home network, add a static route as described below.

Windows:

route add 10.0.0.0 MASK 255.255.0.0 192.168.1.81

Linux:

sudo up route add -net 10.0.0.0 netmask 255.255.0.0 gw 192.168.31.232

Mac OS X:

sudo route -n add 10.0.0.0/16 192.168.31.232

Test it out: