Linux IPSec Site-to-Site VPN: AWS VPC & Mikrotik Router

In this tutorial, we will use the Site-to-Site VPN scenario with the modification and one of the customer site that is using Mikrotik router, which is also acting as gateway for LAN plus the vpn gateway while from the AWS side, we are using the exact same Ubuntu Linux router.

Please review the previous tutorial before starting this tutorial, as I’ll use the previous tutorial as the base for this one.

mikto

Note: Please don’t waste your time in hacking, all these public devices and IP(s) are Temporary, I have destroyed them after finished this tutorial.

VPN Configuration on Mikrotik Site:

Open the IP->IPsec window in WinBox:

1

Create a new Proposal(if you don’t want to use the default) as follows:

2

Now, create a new policy as follows:

From the General Tab

Src Address: Mikrotik LAN 192.168.10.0/24 Subnet
Dst Address: AWS VPC 10.100.0.0/16 Private Subnet

3

From the Action Tab:

SA Src Address: MIkrotik WAN Address 102.162.166.90
SA Dst Address: AWS VPC Linux NAT Router WAN Address 54.219.146.242
Tick the Tunnel checkbox
For Proposal: Use LAN2AWSProposal or whatever proposal you have created in the first step.

4

Next, Move to the Peers tab and create a new peer by using the public address of AWS NAT Instance asAddress:

5

Next, create a NAT Bypass rule, to exclude the AWS VPC Private Subnet(s) to be natted:

nat1

nat2

Placed the above created rule at the top of all other NAT rule(s) and clear the connection table from existing connection or reboot the Mikrotik.

nat3

VPN Configuration on AWS VPC:

Also allow the ICMP packet on internal subnet security group from the remote LAN for testing purpose:

6a

Edit the ipsec.conf file:

vi /etc/ipsec.conf

1

Here is the addition to the ipsec.conf file (please refer to the ipsec.conf file from previous tutorial):

conn AWS2MikrotikConnection
 left=10.100.10.10
 leftsubnets=10.100.0.0/16
 leftid=54.219.146.242
 leftsourceip=10.100.10.10
 right=102.162.166.90
 rightsubnets=192.168.10.0/24
 rightid=102.162.166.90
 pfs=no
 forceencaps=yes
 authby=secret
 auto=start

2

Edit the shared secret file:

vi /etc/ipsec.secrets

3

Mine ipsec.secrets file as an example:

4

Restart the IPSec service:

service ipsec restart

5

Verify the status of IPSec service on Ubuntu at AWS VPC:

service ipsec status

6

Note: Please don’t panic, just restart the service one more time if it didn’t come up.

Verify that the Traffic is passing through the Tunnel:

Ping from the AWS vpn gateway to the Mikrotik LAN IP:

7

Ping from AWS VPC private Subnet to Mikrotik’s LAN for verification:

8

Ping from the Local machine to the machine on VPC Private subnet:

7

8

VERY Useful Tip:

If the Tunnel didn’t come up after the configuration, just restart the server and also start the ping from your LAN host to other side LAN host.

OSPF routing between Cisco,Ubuntu,CentOS and Mikrotik Router!

Scenario:

  • Routers: 1 Ubuntu Linux with 3 nics, 1 Centos Linux with 3 nics, 1 Cisco 3640 Router with 3 FastEthernet interfaces and 1 Mikrotik Router with 2 interfaces.
  • Clients: 3 Windows Xp with 1 nic.
IP Details

All the Routers in this scenario have a default password of “zebra“.

Cisco Router:

  • fe0/0: 10.10.10.1/24
  • fe1/0:10.10.50.1 /24
  • fe2/0: Getting through DHCP

UbuntuRouter:

  • eth0: 10.10.10.2/24
  • eth1: 172.16.10.1/24
  • eth2: 10.10.100.1/24

CentOSRouter:

  • eth0: 172.16.10.2/24
  • eth1: 192.168.10.1/24
  • eth2: 10.10.150.1/24

Mikrotik Router:

  • ether1: 192.168.10.2/24
  • ether2: 10.10.200.1/24

Clients:

  • Ubuntu-Desktop: 10.10.50.50/24
  • WinXP-1: 10.10.100.50/24
  • WinXP-2: 10.10.150.50/24
  • WinXP-3: 10.10.200.50/24

Cisco Router Configuration:

UbuntuRouter Configuration:

Restart the Router!!!

CentOSRouter Configuration:

Restart the Router!!!

Mikrotik Router Configuration:

Neighbor verification from Routers:

Route verification from Routers:

Test from Clients:

Make a simple test from Ubuntu-Desktop.

Make a simple test from WinXP-1.

Make a simple test from WinXP-2.

Make a simple test from WinXP-3.

Configure NAT on Cisco Router:

This is just a bonus section, in which we will configure the NAT on Cisco router and also propagate the default route in OSPF. I connect my Cisco Router to DSL Modem and configure it so that it will take IP address through DHCP, as well as configure the inside and outside interface for NAT.

Lazy man access -list for NAT (This is not the perfect access list):

NAT Overload:

Originate the default route in OSPF:

Verify the last resort information on Cisco Router:

Check default route information on all routers :-)

Hope this will help you!