---
title: 'Tutorial: Extend VPN Connectivity to Amazon AWS VPC Using the AWS VPC VPN Gateway Service'
canonical: https://openvpn.net/as-docs/tutorials/tutorial--extend-vpn-connectivity-to-amazon-aws-vpc-with-gateway-service/
product: Access Server Docs
description: Successfully extend your on-premise Access Server VPN connectivity to your AWS VPC using IPsec. VPN users can access AWS resources securely.
---

# Tutorial: Extend VPN Connectivity to Amazon AWS VPC Using the AWS VPC VPN Gateway Service

## Overview

If you're utilizing Amazon Web Services (AWS), you're likely aware that Amazon Virtual Private Cloud (VPC) offers built-in functionality to connect your on-premise network to your VPC instances. However, suppose you already have an Access Server set up on-premise and wish to extend your VPN connectivity to the Amazon cloud. In that case, you can achieve this without purchasing additional hardware or expensive equipment. This tutorial will guide you through connecting your on-premise Access Server to your Amazon VPC using IPsec. Upon completion, your on-premise VPN users will have seamless access to your AWS resources without complex configurations or installations.

> **Important**
>
> Always ensure your configurations comply with your organization's security policies and AWS best practices. Update your systems regularly and monitor the VPN connections for optimal performance and security.

## Prerequisites

- Access Server installed on your local network.
- An internet-facing IP address for your Access Server instance.
- Strongswan installed.
- AWS Management Console access with permissions to configure VPC settings.
- Non-overlapping subnets between your on-premise and AWS VPC subnets.

## Step 1: Prepare your Access Server

For this first step, you need to enable Strongswan. The process differs if you have Access Server running on a [virtual appliance](https://openvpn.net/as-docs/virtual-machines.md) or installed on-premise with a [software package installation](https://openvpn.net/as-docs/linux-distributions.md).

### For Access Server virtual appliance users:

1. Connect to your console and get root privileges.
2. Strongswan is pre-installed but turned off by default on the Access Server virtual appliance. Run this command to enable it:

   ```
   systemctl enable strongswan-starter.service
   ```
3. Start Strongswan:

   ```
   systemctl start strongswan-starter.service
   ```

### For software package installation users (Access Server installed using the install script):

1. If you're not using the virtual appliance, connect to your console and get root privileges.
2. Install Strongswan manually:

   ```
   apt update
   apt install strongswan
   ```
3. Download the following required configuration files and place them in the appropriate directories:
   - **ipsec.conf:** Save to `/etc/`.

     ```
     wget -O /etc/ipsec.conf https://packages.openvpn.net/as/scripts/ipsec.conf
     ```
   - **ipsec.secrets:** Save to `/etc/`.

     ```
     wget -O /etc/ipsec.secrets https://packages.openvpn.net/as/scripts/ipsec.secrets
     ```
   - **aws-updown.sh:** Save to `/sbin` and make it executable.

     ```
     wget -O /sbin/aws-updown.sh https://packages.openvpn.net/as/scripts/aws-updown.sh
     chmod +x /sbin/aws-updown.sh
     ```

     > **Note**
     >
     > Adjust the package manager commands according to your Linux distribution (e.g., `yum` for CentOS/RHEL).

## Step 2: Configure Amazon VPC for VPN connectivity

1. Sign in to the AWS Management Console.
2. From the list of services, select **VPC** under the **Networking & Content Delivery** category.
3. In the VPC Dashboard, ensure you have at least one VPC listed.
   - If no VPC is present, you may need to create one or check if you're in the correct AWS region.

     > **Tip**
     >
     > Check the top-right corner of the console to confirm your active region

## Step 3: Set up the customer gateway on AWS

1. In the Virtual private network (VPN) section, select **Customer Gateways**.
2. Click **Create Customer Gateway**.
   - **Name Tag:** Enter a descriptive name (e.g., `OnPremiseAccessServer`).
   - **IP Address:** Enter the public IP address of your on-premise Access Server.

     > **Important**
     >
     > This IP must be internet-facing and not behind NAT.
   - Click **Create Customer Gateway** to save settings.

## Step 4: Create a virtual private gateway

1. In the Virtual private network (VPN) section, click **Virtual Private Gateways**.
2. Click **Create Virtual Private Gateway**.
   - **Name Tag:** Enter a descriptive name (e.g., `MyVPCGateway`).
   - Click **Create Virtual Private Gateway**.
3. Select the newly created private gateway.
4. Click **Actions \> Attach to VPC**.
5. Select your VPC from the dropdown.
6. Click **Yes, Attach**.

## Step 5: Update route tables in AWS

1. In the Virtual private cloud section, select **Route Tables**.
2. Choose the route table associated with your VPC subnets.
3. With the route table selected, click the **Route Propagation** tab.
4. Click **Edit Route Propagation**.
5. Click the box next to your virtual private gateway (`vgw-xxxxxxxx`).
6. Click **Save**.

## Step 6: Create the VPN connection

1. In the Virtual private network (VPN) section, select **Site-to-Site VPN connections**.
2. Click **Create VPN Connection**.
3. Configure the VPN connection:
   - **Name Tag:** Enter a descriptive name (e.g., `OnPremiseVPNConnection`).
   - **Target Gateway Type:** Choose **Virtual Private Gateway**.
   - **Virtual Private Gateway:** Select the one previously created.
   - **Customer Gateway:** Select **Existing** and choose your customer gateway.
   - **Routing Options:** Choose **Static**.
   - **Static IP Prefixes:** Enter the CIDR blocks of your on-premise and Access Server VPN networks. Example: `192.0.2.0/24`, `203.0.113.0/24`.
4. Click **Create VPN Connection**.
   - Wait for the connection to be created.
5. Once the VPN connection is available, select it from the list.
6. Click **Download Configuration**.
7. In the dialog, select **Strongswan** for the vendor and click **Download**.
8. Save the configuration file for the next step.

## Step 7: Configure IPsec on your Access Server

1. Locate the downloaded configuration file:
   - Find the Strongswan configuration file you downloaded from the AWS console in Step 6. It's usually named something similar to **vpn-xxxxxxx.conf**.
2. Open the downloaded VPN configuration file.
3. Review the instructions contained within it:
   - Carefully read through the instructions provided in the configuration file. They contain the specific settings and keys required to establish the VPN connection using Strongswan.
4. Implement configuration steps:
   - **Copying keys and secrets:** Transfer the pre-shared keys and other secrets to the appropriate location on your Access Server, e.g., `/etc/ipsec.secrets`.
   - **Modifying 'ipsec.donf':** Update the `ipsec.conf` file with the details provided, such as the tunnel endpoints and other configuration parameters.
   - **Executing commands:** Run any specific commands provided in the file to load and apply the new configurations.

## Step 8: Add a route to AWS VPC via the Access Server host (optional)

This step is necessary if a server-side host connected to Access Server needs to access resources within the AWS VPC. If you don't need this configuration, you can skip this step.

### Configure routing

Configure the routing table on the router or host that needs access to set up routing to the AWS VPC through the Access Server host. This typically involves adding a static route:

1. **Identify the AWS VPC CIDR:** Determine the CIDR block(s) of your AWS VPC, e.g., `10.0.0.0/16`.
2. **Add static route:** Add a static route on your server or host using the following command (adjust based on your Linux distribution and network configuration):

   ```
   ip route add 10.0.0.0/16 via OpenVPN_AS_Host_IP
   ```

   Replace with your VPC CIDR.

   Replace with your Access Server host's IP address.

   **Example:**

   ```
   ip route add 10.0.0.0/16 via 192.0.2.100
   ```
3. **Verify route:** Verify the route has been added successfully:

   ```
   ip route show
   ```

   - You should see the route to your AWS VPC CIDR via the Access Server host listed.

By configuring this route, hosts on your server-side network can reach resources within the AWS VPC through Access Server, extending the VPN connectivity to your entire server network.

## Step 9: Start the VPN connection

1. Start the IPsec service:

   ```
   ipsec start
   ```
2. Check the status of the IPsec tunnels to verify the connection:

   ```
   ipsec status
   ```

   - You should see established Security Associations (SAs), indicating the tunnels are up.
   - If the IPsec tunnels don't establish, run this command:

     ```
     ipsec restart
     ```

## Step 10: Automate VPN startup on system boot

1. Enable the IPsec service at boot:

   ```
   systemctl enable ipsec
   ```
2. (Optional) Add the command to `rc.local`:
   1. Edit the `rc.local` file:

      ```
      nano /etc/rc.local
      ```
   2. Add the following line before the `exit 0` line:

      ```
      ipsec start
      ```
   3. Save and exit.

## Step 11: Test the connection

1. From a machine in your on-premise network, ping an instance in your AWS VPC to test the connectivity from on-premise to AWS:

   ```
   ping AWS_Instance_IP
   ```
2. From an AWS instance, ping a machine on your on-premise network to test connectivity from AWS to on-premise:

   ```
   ping On_premise_Machine_IP
   ```
3. Connect to your Access Server using a VPN client.
4. Ensure that you can access AWS resources as intended.
5. If you need to troubleshoot, check firewall rules on both sides to ensure ICMP (ping) is allowed and review logs for any error messages:

   ```
   cat /var/log/syslog | grep ipsec
   ```

---

Prev: [Cloud and Multi-VPC Connectivity](https://openvpn.net/as-docs/tutorials/cloud-and-multi-vpc-connectivity.md)
Next: [Tutorial: Communicate Between Two VPCs in AWS Using a Single Access Server](https://openvpn.net/as-docs/tutorials/tutorial--connect-two-aws-vpcs-with-a-vpc-peering-connection.md)
Index: https://openvpn.net/as-docs/llms.txt