Knowledgebase Archives - Page 3 of 12

Posted on August 19, 2014August 19, 2014 by thoaimedia — Leave a comment

How to Install the latest version of s3cmd tool on Linux

Please install the required packages before installing the s3cmd tool and download the source zip from github:

sudo yum install unzip python-pip
wget https://github.com/s3tools/s3cmd/archive/master.zip

Unzip the downloaded source zip file and move to the unzipped directory:

unzip master.zip
cd s3cmd-master/

Once you have moved to the unzipped directory then just run this command:

sudo python setup.py install

Install the dateutil module, which is powerful extensions to the datetime module that is available in the Python standard library:

sudo pip install python-dateutil

Check the installed version of s3cmd tool:

s3cmd --version

After installation, run the following command in order to configure the s3cmd tools using your AMAZON ACCESS KEY and SECRET KEY.

s3cmd --configure

Enjoy

Posted on August 19, 2014August 19, 2014 by thoaimedia — Leave a comment

Initial Settings after installing the CentOS 7

1) To change the hostname permanently, edit the following file:

sudo vi /etc/hostname

Here you can simply put the name of your system (in my case, I have assigned it CentOS-7):

After that, edit the hosts file:

sudo vi /etc/hosts

Here add the same name, that you have added in the /etc/hostname file, after 127.0.0.1:

After reboot, it will display the new hostname.

2) After login to the CentOS7 server(minimal installation), you will notice that the system doesn’t have ifconfig command :

Install the net-tools package which will include ifconfig:

sudo yum install net-tools

Try the ifconfig command once again:

3) Change the default network interface name to “eth0″

CentOS7 has a default nic name as “en016…..”, as we can see in above screenshoot. To change it back to the default network device name like “ethX”, edit the grub file:

sudo vi /etc/default/grub

Search for the line “GRUB_CMDLINE_LINUX” and append the following: “net.ifnames=0 biosdevname=0″

Will look like this:

GRUB_CMDLINE_LINUX="rd.lvm.lv=rootvg/usrlv rd.lvm.lv=rootvg/swaplv crashkernel=auto 
vconsole.keymap=usrd.lvm.lv=rootvg/rootlv vconsole.font=latarcyrheb-sun16 rhgb 
quiet net.ifnames=0 biosdevname=0"

Create a new configuration based on the currently running system using grub2-mkconfig command:

sudo grub2-mkconfig -o /boot/grub2/grub.cfg

Rename the interface files by renaming the file “/etc/sysconfig/network-scripts/ifcfg-en01…“

sudo mv /etc/sysconfig/network-scripts/ifcfg-eno16777736 /etc/sysconfig/network-scripts/ifcfg-eth0

Reboot the system:

After reboot, check the interface name:

4) Configure the static ip on the server:

Edit the interface file under /etc/sysconfig/network-scripts/ directory:

sudo vi /etc/sysconfig/network-scripts/ifcfg-eth0

Here is my ifcfg-eth0 file as a sample, please change it according to your requirement:

DEVICE="eth0"
ONBOOT=yes
BOOTPROTO=static
IPADDR=192.168.250.50
NETMASK=255.255.255.0
GATEWAY=192.168.250.2
DNS1=192.168.250.2

Stop and disable the NetworkManager service, because we don’t need it on the server:

sudo systemctl stop NetworkManager 
sudo systemctl disable NetworkManager

Restart the network service(Be careful, if you are connecting remotely, because you will be disconnected after issue this command):

sudo service network restart

Check the newly assigned static ip:

5) Disable IPv6:

First check that IPv6 is enabled or not:

lsmod | grep -i ipv6

Edit the grub file:

sudo vi /etc/default/grub

Search for the line “GRUB_CMDLINE_LINUX” and add the following at the beginning: “ipv6.disable=1″

Will look like this:

GRUB_CMDLINE_LINUX="ipv6.disable=1 rd.lvm.lv=rootvg/usrlv...

Create a new configuration based on the currently running system using grub2-mkconfig command:

sudo grub2-mkconfig -o /boot/grub2/grub.cfg

Reboot the system:

Once again, check the IPv6 on the system:

6) EPEL repository on Centos 7

To install the EPEL repository, issue the following command:

sudo rpm -Uvh http://dl.fedoraproject.org/pub/epel/beta/7/x86_64/epel-release-7-0.2.noarch.rpm

List your new repos:

sudo yum repolist

7) Enable iptables services(instead of firewalld):

When you will try to start/restart the iptables on newly install server, will get this error:

To fix this error, install the iptables-services package:

sudo yum install iptables-services

Re-run the command to restart the iptables:

sudo service iptables restart

Hope this will help you!

Posted on August 19, 2014August 19, 2014 by thoaimedia — Leave a comment

How to Install the latest LEMP Stack on CentOS 6.5

In this tutorial,we’ll learn that how we can install the latest LEMP (Nginx, MySQL & PHP) Stack and it’s initial configuration on CentOS 6.5, because Base and EPEL repo are containing really old version of LEMP Stack.

Please add the required repos by using the following commands:

sudo rpm --import http://ftp.riken.jp/Linux/fedora/epel/RPM-GPG-KEY-EPEL-6
sudo rpm -ivh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
sudo rpm -Uvh http://mirror.webtatic.com/yum/el6/latest.rpm
sudo yum repolist

We’ll have mysql55-libs conflicts with mysql-libs error, if we’ll proceed like this. To resolve this conflict, we need to issue these commands:

sudo yum install yum-plugin-replace
sudo yum replace mysql-libs --replace-with mysql55w-libs

Now, we can safely issue this command to install the latest version of Nginx, MySQL and PHP with PHP-Fpm:

sudo yum install nginx16 mysql55w mysql55w-server php55w php55w-opcache php55w-fpm

Enable Nginx, MySQL and PHP-FPM to automatically begin when the server boot:

sudo chkconfig nginx on
sudo chkconfig mysqld on
sudo chkconfig php-fpm on

Secure the PHP by editing the php.ini file:

sudo vi /etc/php.ini

Uncomment the cgi.fix_pathinfo and change it from 1 to 0:

cgi.fix_pathinfo=0

Edit the /etc/php-fpm.d/www.conf file:

sudo vi /etc/php-fpm.d/www.conf

Change the user and group:

user = nginx
group = nginx

Next we need to do some modification in default nginx.conf file:

sudo vi /etc/nginx/nginx.conf

Increase the worker processes from 1 to 4:

Also delete the default server config block to make the file more concise:

Move to the /etc/nginx/conf.d/ directory:

cd /etc/nginx/conf.d/

Next, we’ll create the virtual host file for our domain (In my case it’s rbgeek.conf):

sudo vi rbgeek.conf

This is a basic virtual host config file:

server {
       listen 80;
       server_name rbgeek.com;

       access_log /var/log/nginx/rbgeek_access.log main;
       error_log /var/log/nginx/rbgeek_error.log;
     
   location / {
       root /var/www/rbgeek;
       index index.php index.html index.htm;
   }
   
   # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000

   location ~ .php$ {
       root /var/www/rbgeek;
       fastcgi_pass 127.0.0.1:9000;
       fastcgi_index index.php;
       fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
       include fastcgi_params;
       fastcgi_intercept_errors on;
   }
}

Finally, restart the Nginx and PHP-FPM services:

sudo service nginx restart
sudo service php-fpm restart

Create a directory structure for the website under /var/www/.If you have another preference, please update the config files accordingly:

sudo mkdir -p /var/www/rbgeek

Adjust the permission:

sudo chgrp -R nginx /var/www/rbgeek
sudo chmod g+s /var/www/rbgeek

Create a phpinfo page to verify that the php is working correctly with Nginx:

sudo vi /var/www/rbgeek/info.php

Add the following code in it:

<?php
phpinfo();
?>

Navigate to the site in web browser and verify that the php information is returned:

http://rbgeek.com/info.php

(Optional) Verify that all the packages are updated by using the code in your index page:

Hope this will help you!

Posted on August 19, 2014August 19, 2014 by thoaimedia — Leave a comment

How To Install WordPress with Nginx in Ubuntu Server 14.04 LTS

Install the LEMP stack(Linux, Nginx, Mysql, PHP) with the command below:

sudo apt-get install nginx mysql-server php5-fpm php5-mysql

Note: Please set the MySQL root password, when it will prompt for it during the installation of MySQL-Server.

Secure the PHP by editing the php.ini file:

sudo vi /etc/php5/fpm/php.ini

Uncomment the cgi.fix_pathinfo and change it from 1 to 0:

cgi.fix_pathinfo=0

Create the new virtual host for wordpress (In my case, I have named it tendosite):

sudo vi /etc/nginx/sites-available/tendosite

Add the following code to the virtual host file (change these parameters that are marked with blue colour):

server {
             listen 80;
             server_name rbgeek.com;
            
             root /var/www/wordpress;
             index index.php index.html index.htm;

             location / {
                try_files $uri $uri/ /index.php?q=$uri&$args;
             }
       
             error_page 404 /404.html;
             error_page 500 502 503 504 /50x.html;

             location = /50x.html {
                root /usr/share/nginx/html;
             }

             location ~ .php$ {
                try_files $uri =404;
                fastcgi_split_path_info ^(.+.php)(/.+)$;
                fastcgi_pass unix:/var/run/php5-fpm.sock;
                fastcgi_index index.php;
                include fastcgi_params;
              }
}

Enable the virtual host by creating it’s link inside the /etc/nginx/sites-enabled:

sudo ln -s /etc/nginx/sites-available/tendosite /etc/nginx/sites-enabled/tendosite

Change the permission and owner of php5-fpm.sock by editing the /etc/php5/fpm/pool.d/www.conf file:

sudo vi /etc/php5/fpm/pool.d/www.conf

Remove the comment for listen.mode, .group and .owner:

listen.owner = www-data
listen.group = www-data
listen.mode = 0660

To start the MySQL command-line client, use this command:

mysql -u root -p

Create a wordpress database and granting all privileges to the wordpress user on that database:

CREATE DATABASE wordpress;
GRANT ALL PRIVILEGES ON wordpress.* TO wpuser@localhost IDENTIFIED BY 'password';
FLUSH PRIVILEGES;
EXIT;

Note: In this tutorial, wpuser will be used for wordpress.

Download the latest version of wordpress:

wget http://wordpress.org/latest.tar.gz

Use this command to unpack the WordPress files:

tar -zxvf latest.tar.gz

Move to the extracted wordpress directory and change the name of the config file from wp-config-sample.php towp-config.php and then edit the wp-config.php file:

cd wordpress/
mv wp-config-sample.php wp-config.php
vi wp-config.php

Insert your MySQL settings that you have created for wordpress:

Create the wordpress directory inside www and move all the wordpress file to it:

sudo mkdir -p /var/www/wordpress
sudo cp -r * /var/www/wordpress/

Change the ownership of /var/www/wordpress directory to www-data:

sudo chown -R www-data. /var/www/wordpress

Move to the /var/www/wordpress/ directory and check the permission:

cd /var/www/wordpress/
ls -l

Restart the nginx service:

sudo service nginx restart

Finally restart the php5-fpm service:

sudo service php5-fpm restart

Open up the browser and go to http://hostname/wp-admin/install.php to begin configuring WordPress:

http://rbgeek.com/wp-admin/install.php

Congratulations!

Hope this will help you!

Posted on August 19, 2014August 19, 2014 by thoaimedia — Leave a comment

Linux IPSec Site-to-Site VPN: AWS VPC & Cisco Router

In this tutorial, we will use the Site-to-Site VPN scenario with the modification and one of the customer site that is using Cisco router, which is also acting as gateway for LAN plus the vpn gateway while from the AWS side, we are using the exact same Ubuntu Linux router.

Please review the previous tutorial before starting this tutorial, as I’ll use the previous tutorial as the base for this one.

Note: Please don’t waste your time in hacking, all these public devices and IP(s) are Temporary, I have destroyed them after finished this tutorial.

VPN Configuration on Cisco Site:

First step is to configure an ISAKMP Phase 1 policy:

crypto isakmp policy 1
encryption aes 128
hash sha
authentication pre-share
group 2

Next, we need to set the pre-shared key for authentication with the AWS peer:

crypto isakmp key $VER_SEC_PSK address 54.219.146.242

Next step is to create the transform set (We have named it AWSTrans), which will be used to protect the data:

crypto ipsec transform-set AWSTrans esp-aes esp-sha-hmac

After that we have to define the Traffic to be protected through the VPN Tunnel using the access-list:

ip access-list extended VPN-TRAFFIC
permit ip 192.168.168.0 0.0.0.255 10.100.0.0 0.0.255.255

Now, we need to define the Crypto Map which will connect the ISAKMP and IPSec configuration together, that we have defined above:

crypto map AWSMAP 10 ipsec-isakmp
 set peer 54.219.146.242
 set transform-set AWSTrans
 match address VPN-TRAFFIC

Apply the Crypto Map to the outgoing interface of the router (In our case, it is FastEthernet 0/0)

interface FastEthernet0/0
crypto map AWSMAP

Check the NAT access-list before proceeding:

Add the NAT Bypass entry inside the NAT access-list before the NAT entry, to exclude the AWS VPC Private Subnet(s) to be NAT’d:

ip access-list extended NAT-TRAFFIC
5 deny ip 192.168.168.0 0.0.0.255 10.100.0.0 0.0.255.255

NAT access-list after modification:

VPN Configuration on AWS VPC:

Also allow the ICMP packet on internal subnet security group from the remote LAN for testing purpose:

Edit the ipsec.conf file:

vi /etc/ipsec.conf

Here is the addition to the ipsec.conf file (please refer to the ipsec.conf file from previous tutorial):

conn AWS2CiscoConnection
 left=10.100.10.10
 leftsubnets=10.100.0.0/16
 leftid=54.219.146.242
 leftsourceip=10.100.10.10
 right=25.109.210.75
 rightsubnets=192.168.168.0/24
 rightid=25.109.210.75
 pfs=no
 forceencaps=yes
 authby=secret
 auto=start

Edit the shared secret file:

vi /etc/ipsec.secrets

Mine ipsec.secrets file as an example:

Restart the IPSec Service & verify the Tunnel status on both Sides:

Restart the IPSec service on Ubuntu at AWS VPC:

service ipsec restart

Verify the status of IPSec service on Ubuntu at AWS VPC:

service ipsec status

Note: Please don’t panic, just restart the service one more time if it didn’t come up.

Verify the status of IPSec Tunnel on Cisco:

show crypto isakmp sa

Verify that the Traffic is passing through the Tunnel:

Ping from the AWS vpn gateway to the Cisco LAN IP:

Ping from AWS VPC private Subnet to Cisco’s LAN for verification:

Ping from the Local machine to the machine on VPC Private subnet:

Posted on August 19, 2014August 19, 2014 by thoaimedia — Leave a comment

Linux IPSec Site-to-Site VPN: AWS VPC & Vyatta Firewall

In this tutorial, we will use the Site-to-Site VPN scenario with the modification and one of the customer site that is using Vyatta firewall, which is also acting as gateway for LAN plus the vpn gateway while from the AWS side, we are using the exact same Ubuntu Linux router.

Please review the previous tutorial before starting this tutorial, as I’ll use the previous tutorial as the base for this one.

Note: Please don’t waste your time in hacking, all these public devices and IP(s) are Temporary, I have destroyed them after finished this tutorial.

VPN Configuration on Vyatta Site:

First, we need to configure 2 NAT rules, to exclude the traffic between AWS VPC Private Subnet(s) and LAN to be NAT’d, Please place these rules above all other NAT rules:

set nat source rule 5 destination address '172.30.30.0/24'
set nat source rule 5 source address '10.100.0.0/16'
set nat source rule 5 outbound-interface 'eth0'
set nat source rule 5 'exclude'

set nat source rule 7 source address '172.30.30.0/24'
set nat source rule 7 destination address '10.100.0.0/16'
set nat source rule 7 outbound-interface 'eth0'
set nat source rule 7 'exclude'

In the next step, we need to define the Phase 1 and 2 policies:

set vpn ipsec ike-group IKE-AWS-POLICY lifetime '28800'
set vpn ipsec ike-group IKE-AWS-POLICY proposal 1 encryption 'aes128'
set vpn ipsec ike-group IKE-AWS-POLICY proposal 1 hash 'sha1'
set vpn ipsec ike-group IKE-AWS-POLICY proposal 1 dh-group '2'

set vpn ipsec esp-group ESP-AWS-POLICY lifetime '3600'
set vpn ipsec esp-group ESP-AWS-POLICY pfs disable
set vpn ipsec esp-group ESP-AWS-POLICY proposal 1 encryption 'aes128'
set vpn ipsec esp-group ESP-AWS-POLICY proposal 1 hash 'sha1'

Next step is VPN configuration, i.e assignment of previously created policies and shared secret etc.

set vpn ipsec ipsec-interfaces interface 'eth0'

set vpn ipsec site-to-site peer 54.219.146.242 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 54.219.146.242 authentication pre-shared-secret '$VER_SEC_PSK'
set vpn ipsec site-to-site peer 54.219.146.242 default-esp-group 'ESP-AWS-POLICY'
set vpn ipsec site-to-site peer 54.219.146.242 ike-group 'IKE-AWS-POLICY'
set vpn ipsec site-to-site peer 54.219.146.242 local-address '102.162.166.94'
set vpn ipsec site-to-site peer 54.219.146.242 tunnel 1 local prefix '172.30.30.0/24'
set vpn ipsec site-to-site peer 54.219.146.242 tunnel 1 remote prefix '10.100.0.0/16'

Finally, don’t forget to adjust your firewall rules as per your requirement:

set firewall name INSIDE-FW rule 10 action 'accept'
set firewall name INSIDE -FW rule 10 destination address '10.100.0.0/16'
set firewall name INSIDE-FW rule 10 source address '172.30.30.0/24'

set firewall name OUTSIDE-FW rule 10 action 'accept'
set firewall name OUTSIDE-FW rule 10 ipsec 'match-ipsec'

VPN Configuration on AWS VPC:

Also allow the ICMP packet on internal subnet security group from the remote LAN for testing purpose:

Edit the ipsec.conf file:

vi /etc/ipsec.conf

Here is the addition to the ipsec.conf file (please refer to the ipsec.conf file from previous tutorial):

conn AWS2VyattaConnection
 left=10.100.10.10
 leftsubnets=10.100.0.0/16
 leftid=54.219.146.242
 leftsourceip=10.100.10.10
 right=102.162.166.94
 rightsubnets=172.30.30.0/24
 rightid=102.162.166.94
 pfs=no
 forceencaps=yes
 authby=secret
 auto=start

Edit the shared secret file:

vi /etc/ipsec.secrets

Mine ipsec.secrets file as an example:

Restart the IPSec Service & verify the Tunnel status on both Sides:

Restart the IPSec service on Ubuntu at AWS VPC:

service ipsec restart

Reset the vpn tunnel on Vyatta:

reset vpn ipsec-peer 54.219.146.242

Verify the status of IPSec Tunnel on Ubuntu at AWS VPC:

service ipsec status

Verify the status of IPSec Tunnel on Vyatta:

show vpn ipsec sa

Verify the Route Table on both servers:

route -n

show ip route

Verify that the Traffic is passing through the Tunnel:

Ping from AWS VPC private Subnet to Vyatta’s LAN for verification:

Ping from Vyatta’s LAN to AWS VPC private Subnet for verification:

Posted on August 19, 2014August 19, 2014 by thoaimedia — Leave a comment

Automated installation of LAMP stack on Ubuntu Server

In this tutorial, I’ll show you that how we can install the LAMP stack on Ubuntu Server interactively.

First create the script :

vi lamp.sh

Copy and Paste the following code into it (Modify the MySQL root Password,as per your requirement):

#!/bin/bash

#Instructions to use this script 
#
#chmod +x SCRIPTNAME.sh
#
#sudo ./SCRIPTNAME.sh

echo "###################################################################################"
echo "Please be Patient: Installation will start now.......and it will take some time :)"
echo "###################################################################################"

#Update the repositories

sudo apt-get update

#Apache, Php, MySQL and required packages installation

sudo apt-get -y install apache2 php5 libapache2-mod-php5 php5-mcrypt php5-curl php5-mysql php5-gd php5-cli php5-dev mysql-client
php5enmod mcrypt

#The following commands set the MySQL root password to MYPASSWORD123 when you install the mysql-server package.

sudo debconf-set-selections <<< 'mysql-server mysql-server/root_password password MYPASSWORD123'
sudo debconf-set-selections <<< 'mysql-server mysql-server/root_password_again password MYPASSWORD123'

sudo apt-get -y install mysql-server

#Restart all the installed services to verify that everything is installed properly

echo -e "n"

service apache2 restart && service mysql restart > /dev/null

echo -e "n"

if [ $? -ne 0 ]; then
   echo "Please Check the Install Services, There is some $(tput bold)$(tput setaf 1)Problem$(tput sgr0)
else
   echo "Installed Services run $(tput bold)$(tput setaf 2)Sucessfully$(tput sgr0)"
fi

echo -e "n"

Then set the execute permission for your shell script:

chmod +x lamp.sh

Now, execute the shell script as sudo user:

sudo ./lamp.sh

Hope this will help you!

Posted on August 19, 2014August 19, 2014 by thoaimedia — Leave a comment

Linux IPSec Site-to-Site VPN: AWS VPC & Mikrotik Router

In this tutorial, we will use the Site-to-Site VPN scenario with the modification and one of the customer site that is using Mikrotik router, which is also acting as gateway for LAN plus the vpn gateway while from the AWS side, we are using the exact same Ubuntu Linux router.

Please review the previous tutorial before starting this tutorial, as I’ll use the previous tutorial as the base for this one.

Note: Please don’t waste your time in hacking, all these public devices and IP(s) are Temporary, I have destroyed them after finished this tutorial.

VPN Configuration on Mikrotik Site:

Open the IP->IPsec window in WinBox:

Create a new Proposal(if you don’t want to use the default) as follows:

Now, create a new policy as follows:

From the General Tab

Src Address: Mikrotik LAN 192.168.10.0/24 Subnet
Dst Address: AWS VPC 10.100.0.0/16 Private Subnet

From the Action Tab:

SA Src Address: MIkrotik WAN Address 102.162.166.90
SA Dst Address: AWS VPC Linux NAT Router WAN Address 54.219.146.242
Tick the Tunnel checkbox
For Proposal: Use LAN2AWSProposal or whatever proposal you have created in the first step.

Next, Move to the Peers tab and create a new peer by using the public address of AWS NAT Instance asAddress:

Next, create a NAT Bypass rule, to exclude the AWS VPC Private Subnet(s) to be natted:

Placed the above created rule at the top of all other NAT rule(s) and clear the connection table from existing connection or reboot the Mikrotik.

VPN Configuration on AWS VPC:

Also allow the ICMP packet on internal subnet security group from the remote LAN for testing purpose:

Edit the ipsec.conf file:

vi /etc/ipsec.conf

Here is the addition to the ipsec.conf file (please refer to the ipsec.conf file from previous tutorial):

conn AWS2MikrotikConnection
 left=10.100.10.10
 leftsubnets=10.100.0.0/16
 leftid=54.219.146.242
 leftsourceip=10.100.10.10
 right=102.162.166.90
 rightsubnets=192.168.10.0/24
 rightid=102.162.166.90
 pfs=no
 forceencaps=yes
 authby=secret
 auto=start

Edit the shared secret file:

vi /etc/ipsec.secrets

Mine ipsec.secrets file as an example:

Restart the IPSec service:

service ipsec restart

Verify the status of IPSec service on Ubuntu at AWS VPC:

service ipsec status

Note: Please don’t panic, just restart the service one more time if it didn’t come up.

Verify that the Traffic is passing through the Tunnel:

Ping from the AWS vpn gateway to the Mikrotik LAN IP:

Ping from AWS VPC private Subnet to Mikrotik’s LAN for verification:

Ping from the Local machine to the machine on VPC Private subnet:

VERY Useful Tip:

If the Tunnel didn’t come up after the configuration, just restart the server and also start the ping from your LAN host to other side LAN host.

Posted on August 19, 2014August 19, 2014 by thoaimedia — Leave a comment

Site-to-Site VPN between AWS VPC and Customer Site using Linux

In this tutorial, we will use the previous scenario on AWS side for the creation of site-to-site vpn between AWS VPC and Local site. On Amazon side, we’ll use Ubuntu 14.04 LTS, which will act as gateway for private subnet(s) plus the vpn gateway, while on the Local site, we’ll use the CentOS 6.5, which will perform the same tasks as of Ubuntu on AWS side (gateway for LAN plus vpn gateway).

Note: Please don’t waste your time in hacking, all these public devices and IP(s) are Temporary, I have destroyed them after finished this tutorial.

VPN Configuration on AWS VPC:

Please add the udp ports 500 & 4500 on NAT instance security group:

Also allow the ICMP packet on internal subnet security group from the remote LAN for testing purpose:

Now, install the desired package(s) for ipsec:

apt-get install iptables openswan

Edit the sysctl.conf file:

vi /etc/sysctl.conf

Add the following parameters inside it:

net.ipv4.ip_forward=1

net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.rp_filter = 0

net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.all.log_martians = 0

net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

net.ipv4.neigh.default.gc_thresh1 = 1024
net.ipv4.neigh.default.gc_thresh2 = 2048
net.ipv4.neigh.default.gc_thresh3 = 4096

Modify the rc.local file:

vi /etc/rc.local

Modify the MASQUERADE rule that we had added in the previous tutorial (Please adjust it according to your scenario):

iptables -t nat  -A POSTROUTING -s 10.100.0.0/16 ! -d 172.16.10.0/24 -o eth0 -j MASQUERADE

Note: Please Reboot your machine once, so that changes will take effect.

Edit the ipsec.conf file:

vi /etc/ipsec.conf

Here is mine working ipsec.conf file, please adjust your’s as per your requirement:

version 2.0

config setup
 nat_traversal=yes
 protostack=netkey
 force_keepalive=yes
 keep_alive=60
 oe=off
 nhelpers=0

conn AWS2LocalConnection
 left=10.100.10.10
 leftsubnets=10.100.0.0/16
 leftid=54.219.146.242
 leftsourceip=10.100.10.10
 right=25.109.210.76
 rightsubnets=172.16.10.0/24
 rightid=25.109.210.76
 pfs=no
 forceencaps=yes
 authby=secret
 auto=start

Edit the shared secret file:

vi /etc/ipsec.secrets

Mine ipsec.secrets file as an example:

VPN Configuration on Local Site:

Before beginning the configuration, please verify that the selinux is disabled:

sestatus

Install the openswan on CentOS, along with the desired packages:

yum install wget bind-utils openswan lsof

Configure the Openswan to start at boot time:

chkconfig ipsec on

Edit the sysctl.conf file on CentOS:

vi /etc/sysctl.conf

Add/Edit the following parameters:

net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

Edit the iptables rule file:

vi /etc/sysconfig/iptables

Modify your iptables file according to your scenario, here are the desired iptables rules, please adjust them accordingly:

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -s 172.16.10.0/24 ! -d 10.100.0.0/16 -o eth0 -j MASQUERADE
COMMIT
###########
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i eth1 -p udp -m udp --sport 67:68 --dport 67:68 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -i eth0 -p esp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4500 -j ACCEPT
-A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -o eth0 -j ACCEPT
COMMIT

Note: Please Reboot your machine once, so that changes will take effect.

Edit the ipsec.conf file:

vi /etc/ipsec.conf

Here is mine working ipsec.conf file on Local site, please adjust your’s as per your requirement:

version 2.0

config setup
 nat_traversal=yes
 protostack=netkey
 force_keepalive=yes
 keep_alive=60
 oe=off
 nhelpers=0

conn Local2AWSConnection
 type=tunnel
 left=172.16.10.10
 leftsubnets=172.16.10.0/24
 leftid=25.109.210.76
 leftsourceip=172.16.10.10
 right=54.219.146.242
 rightsubnets=10.100.0.0/16
 rightid=54.219.146.242
 pfs=no
 forceencaps=yes
 authby=secret
 auto=start

Edit the shared secret file:

vi /etc/ipsec.secrets

Mine ipsec.secrets file as an example on Local Site:

Restart the IPSec Service & verify its status on both Sides:

Restart the IPSec service on Ubuntu at AWS VPC:

service ipsec restart

Restart the IPSec service on CentOS at Local Site:

service ipsec restart

Verify the status of IPSec service on Ubuntu at AWS VPC:

service ipsec status

Verify the status of IPSec service on CentOS at Local Site:

service ipsec status

Verify the IPSec Tunnel status on both servers:

ipsec whack --status | grep -i established

Note: established means that tunnel is up and traffic will traverse through it

Verify the Route Table on both servers:

route -n

Verify that the Traffic is passing through the Tunnel:

Ping from the AWS vpn gateway to the machine on Local LAN (I have Win XP machine on local LAN with an ip 172.16.10.100).

Ping from AWS VPC private Subnet to Local LAN for verification:

Ping from the Local vpn gateway to the machine on VPC Private subnet (I have Webserver on private subnet with an ip 10.100.20.20).

Ping from Local LAN to AWS VPC private Subnet for verification:

Testing Without Ping (Using the following reference)

If you don’t have a box to target that should respond to ping, you can try running a port scan to see if you can at least reach the machine.

# nmap -PN <something_on_right_subnet>

Monitoring traffic

While you’re running your ping or nmap, you can view the traffic with tcpdump.

# tcpdump -n host <RIGHT_PUBLIC_IP>

If you don’t see ESP packets in tcpdump, then they aren’t being tunneled. Try:

# tcpdump -n host <something_on_right_subnet>

If that shows ICMP (or other if using nmap) packets, then you’re sending packets around the tunnel.

VERY Useful Tip:

If the Tunnel didn’t come up after the configuration, just restart the server and also start the ping from your LAN host to other side LAN host.

Please Remember me in your prayers!

Enjoy 🙂

References:

1) http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenario2.html
2) https://gist.github.com/winhamwr/2871257
3) http://stackoverflow.com/questions/21761830/site-to-site-openswan-vpn-tunnel-issues-with-aws
4) http://clauseriksen.net/2011/02/02/ipsec-on-debianubuntu/
5) http://blog.earth-works.com/2013/02/22/how-to-set-up-openswan-l2tp-vpn-server-on-centos-6/
6)https://raymii.org/s/tutorials/IPSEC_L2TP_vpn_on_CentOS_-_Red_Hat_Enterprise_Linux_or_Scientific_-_Linux_6.html
7)http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch35_:_Configuring_Linux_VPNs#.U1tZZ-aSwuj
8) http://www.whiteboardcoder.com/2012/12/amazon-aws-vpc-iptables-and-nat-route.html

Posted on August 19, 2014August 19, 2014 by thoaimedia — Leave a comment

Add a Custom NAT instance in AWS VPC

In this tutorial, I am assuming that you have already created VPC with Public and Private subnets

In the above scenario, we’ll create a micro instance inside the public subnet with an IP 10.100.10.0/24, which will act as the gateway for all the instance(s) inside the private subnet (10.100.20.0/24).

Also, please create the separate Security Group for NAT instance:

After the creation of the NAT instance, you will notice, that it doesn’t have Public IP:

To Fix this, select the Elastic IPs from the VPC console and click on “Allocate New Addresses“, select the VPCfrom “EIP used in” and click on “Yes,Allocate” :

Assign the allocated Elastic IP to the NAT instance:

Now, NAT instance has also Public IP:

From the EC2 console right click on NAT instance and select “Change Source / Dest. Check”:

Click on “Yes,Disable“

Connect to the NAT instance using terminal emulation software (i.e. putty), and allow the ip forwarding on it:

Uncomment the following line:

net.ipv4.ip_forward=1

Note: Please reboot the machine after enabling the ip forwarding or run this command “sysctl -p“

Issue the Iptables command for MASQUERADE:

iptables -t nat -A POSTROUTING -o eth0 -s 10.100.20.0/24 -j MASQUERADE

Note: Please adjust your Subnet in above iptables command.

Modify the NAT instance security group to allow all or desired inbound traffic from private subnet (In my case, 10.100.20.0/24) or desired server.

Create a custom route, associate your private subnet(s) to it and make a default route to use the NAT instance as a gateway:

Testing from Server inside the Private Subnet:

Edit the /etc/rc.local file:

vi /etc/rc.local

Add following to the rc.local before “exit 0“, so that, MASQUERADE will automatically enable at boot time:

iptables -t nat -A POSTROUTING -o eth0 -s 10.100.20.0/24 -j MASQUERADE