{"id":1960,"date":"2024-03-19T12:20:27","date_gmt":"2024-03-19T10:20:27","guid":{"rendered":"https:\/\/upcloud.com\/global\/us\/resources\/tutorials\/set-up-site-to-site-vpn-connection\/"},"modified":"2024-03-19T12:20:27","modified_gmt":"2024-03-19T10:20:27","slug":"set-up-site-to-site-vpn-connection","status":"publish","type":"tutorial","link":"https:\/\/upcloud.com\/global\/resources\/tutorials\/set-up-site-to-site-vpn-connection\/","title":{"rendered":"How to set up site-to-site VPN connection"},"content":{"rendered":"\n<blockquote class=\"wp-block-quote is-style-plain is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Note!<\/strong> VPN functionality is currently in beta testing with limited availability. Customers can request access to beta features by contacting our customer support. Beta features are exempt from our Service Level Agreement. NAT &amp; VPN Gateways connect Cloud Servers in private networks with external networks.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/upcloud.com\/global\/docs\/products\/networking\/features\/gateways\/\">VPN Gateway<\/a> is used to connect securely to external networks through a VPN endpoint. It operates in conjunction with our SDN Router, which can connect with one or multiple SDN Private Networks. All Cloud Servers connected to an SDN Private Network can access the external networks via the Gateway.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this tutorial, we will demonstrate how to set up a VPN connection between two UpCloud VPN instances by completing the following steps:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Create two SDN Private Networks in two different data centres<\/li>\n\n\n\n<li>Create two cloud servers and connect them to those SDN Private Networks<\/li>\n\n\n\n<li>Connect each of the&nbsp; SDN Private Networks with a VPN Gateway through an SDN Router<\/li>\n\n\n\n<li>Connect the VPN Gateways with a VPN tunnel<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Please note that the feature is a route-based site-to-site VPN. Policy-based VPN is not supported.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The VPN instances can be in different locations or even on different UpCloud accounts. Furthermore, this concept can also be used to set up VPN connections to any other IPSec VPN endpoint, including other cloud providers.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Overview<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For this example, we will use the following configuration:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Our locations will be <strong>de-fra1<\/strong> and <strong>us-nyc1<\/strong>.<\/li>\n\n\n\n<li>SDN Private Networks will use IP subnets <strong>192.168.100.0\/24<\/strong> and <strong>192.168.200.0\/24<\/strong>, respectively.<\/li>\n\n\n\n<li>Servers will be <strong>automatically assigned an IP address<\/strong> from those networks, and since they are the first and only servers in those networks, they will get IP addresses <strong>192.168.100.2<\/strong> and <strong>192.168.200.2<\/strong>. The router automatically reserves the first IP in a connected network.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/upcloud.com\/media\/vpn-network-diagram-1024x339.png\" alt=\"-\" class=\"wp-image-38718\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Creating SDN Private Networks<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Start by creating the SDN Private Networks, log in to your <a href=\"https:\/\/hub.upcloud.com\/\">UpCloud Control Panel<\/a> and go to the <em>Private Networks<\/em> section under the <em>Networks<\/em> menu.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Create the following SDN Private Networks. Ensure the IP ranges don\u2019t overlap with your existing networks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DHCP is configured to automatically provide IP addresses to the servers and a route towards the private network on the other side of the VPN tunnel.<\/p>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-8f761849 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p class=\"wp-block-paragraph\">For the network in de-fra1:<br>Name: a descriptive name<br>Location: de-fra1<br>IP network: 192.168.100.0\/24<br>Enable DHCP: Yes<br>Add default route by DHCP: No<br>DHCP Routes: 192.168.200.0\/24<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p class=\"wp-block-paragraph\">For the network in us-nyc1: <br>Name: a descriptive name <br>Location: us-nyc1 IP <br>network: 192.168.200.0\/24 <br>Enable DHCP: Yes <br>Add default route by DHCP: No <br>DHCP Routes: 192.168.100.0\/24 <\/p>\n<\/div>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The configurations should look as follows:<\/p>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-8f761849 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/upcloud.com\/media\/create-sdn-1.png\" alt=\"-\" class=\"wp-image-38722\" \/><\/figure>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/upcloud.com\/media\/create-sdn-2.png\" alt=\"-\" class=\"wp-image-38723\" \/><\/figure>\n<\/div>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Creating SDN Routers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Next, we will create two SDN Routers that will connect the SDN Private Networks with VPN Gateways. SDN Routers are created in the <em>Routers<\/em> section under <em>Network<\/em>. Create two routers, for example, a \u201cFrankfurt VPN test router\u201d and a \u201cNew York VPN test router\u201d, and attach the newly created SDN Private Networks to these. Unselect the \u201cAdd DHCP routes\u201d and \u201cEnable DHCP and add default route by DHCP\u201d options, as shown in the picture below.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/upcloud.com\/media\/attach-sdn-router-1024x776.png\" alt=\"-\" class=\"wp-image-38721\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Creating Cloud Servers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To continue, you will need Cloud Servers in both locations to test the VPN connection. These can be created from the Servers section under the <em>Server list<\/em> by clicking the <em>Deploy server<\/em> button. Create one in <strong>de-fra1<\/strong> and another in <strong>us-nyc1<\/strong>. We will use Ubuntu 22.04 LTS for this tutorial, but any other operating system will work similarly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">During the Cloud Server configuration, you must select the SDN Private Network from each location from the <em>Attach private network<\/em> dialogue.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/upcloud.com\/media\/attach-sdn-network.png\" alt=\"-\" class=\"wp-image-38719\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In this tutorial, we\u2019ll leave the public IPv4, the Utility network and public IPv6 connections enabled, as they help connect to the servers without the VPN connection being available yet. Note that if you plan to use IPs from the 10.0.0.0\/8 range in your SDN networks, the Utility network will overlap as it occupies the whole range by default. Disabling public connectivity and only connecting to the servers from a private network is highly recommended in a secure production setup.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Creating VPN Gateways and configuring the VPN tunnel<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Finally, with the necessary setup done, you can create the VPN Gateways. This is done in the <em>VPN<\/em> menu under the <em>Network<\/em> section. Create one VPN Gateway for each of the locations. You will need to pick the newly created SDN Routers when creating each of the gateways. Wait until the configured status of both gateways changes from <em>Configuring<\/em> to <em>Running<\/em>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You should now see both gateways on the VPN page. Open the details page for each gateway and note both gateways&#8217; public IP addresses.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open the gateway created in <strong>de-fra1<\/strong>, go to the <em>VPN connections<\/em> tab, and choose <em>Configure connections<\/em>. Then choose &#8220;<em>Add new tunnel<\/em>&#8221; and add the IP address of the<strong> us-nyc1<\/strong> gateway as the <em>Remote IP address<\/em>. Take note of the <em>Pre-Shared Key<\/em>, which you will need when configuring the other end of the tunnel. An automatically generated pre-shared key is provided, secure and of adequate length.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Add the following local and remote routes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>UpCloud route: 192.168.100.0\/24<\/li>\n\n\n\n<li>Remote route: 192.168.200.0\/24<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Then open the gateway created in <strong>us-nyc<\/strong> and configure it similarly:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Remote IP address: the de-fra1 VPN gateway public IP address<\/li>\n\n\n\n<li>Pre-Shared Key: the same key used as in de-fra1<\/li>\n\n\n\n<li>UpCloud route: 192.168.200.0\/24<\/li>\n\n\n\n<li>Remote route: 192.168.100.0\/24<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The configuration in <strong>de-fra1<\/strong> should look as follows:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/upcloud.com\/media\/vpn-gateway-1024x781.png\" alt=\"-\" class=\"wp-image-38720\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Note!<\/strong> The connection will remain in the <em>Unavailable<\/em> state until there is traffic towards the VPN tunnel.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Verify the VPN connection<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The networks are now securely connected through the VPN gateways. The servers have received IP addresses automatically from the DHCP server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, our server in <strong>de-fra1<\/strong> has the following configuration on the SDN Private Network interface (eth3).<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">root@vpn-test-server-de-fra1:~# ip a show dev eth3\n5: eth3: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc fq_codel state UP group default qlen 1000\n    link\/ether aa:aa:12:23:9a:25 brd ff:ff:ff:ff:ff:ff\n    altname enp0s6\n    altname ens6\n    inet 192.168.100.2\/24 metric 100 brd 192.168.100.255 scope global dynamic eth3\n       valid_lft 3107sec preferred_lft 3107sec\n    inet6 fe80::a8aa:12ff:fe23:9a25\/64 scope link\n       valid_lft forever preferred_lft forever<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The server has received routes from DHCP, and we can see how servers on the New York SDN Private Network are routed using the server\u2019s routing table. The network is reachable through the router on 192.168.100.1 from the same eth3 interface.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">root@vpn-test-server-de-fra1:~# ip route get 192.168.200.2\n192.168.200.2 via 192.168.100.1 dev eth3 src 192.168.100.2 uid 0\n    cache<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Lastly, we will test the connectivity by pinging the New York server from Frankfurt. Note that due to the stateless nature of IPSec connections, it is normal for the connection to take a few seconds to form. Therefore, it is normal for the first packets to be dropped.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">root@vpn-test-server-de-fra1:~# ping 192.168.200.2\nPING 192.168.200.2 (192.168.200.2) 56(84) bytes of data.\n64 bytes from 192.168.200.2: icmp_seq=1 ttl=60 time=79.1 ms\n64 bytes from 192.168.200.2: icmp_seq=2 ttl=60 time=78.2 ms\n64 bytes from 192.168.200.2: icmp_seq=3 ttl=60 time=78.4 ms<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusions<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">That&#8217;s it! You should now have a secure site-to-site VPN connecting your SDN Private Networks in two different locations. Following the same configuration model, you could connect your UpCloud resources with any other IPSec VPN endpoint, even other cloud providers.<\/p>\n","protected":false},"author":3,"featured_media":38746,"comment_status":"open","ping_status":"closed","template":"","community-category":[259,247],"class_list":["post-1960","tutorial","type-tutorial","status-publish","has-post-thumbnail","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/tutorial\/1960","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/tutorial"}],"about":[{"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/types\/tutorial"}],"author":[{"embeddable":true,"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/comments?post=1960"}],"version-history":[{"count":0,"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/tutorial\/1960\/revisions"}],"wp:attachment":[{"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/media?parent=1960"}],"wp:term":[{"taxonomy":"community-category","embeddable":true,"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/community-category?post=1960"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}