On Premise Server

vim /etc/yum.repos.d/fedora.repo

sudo dnf --enablerepo=fedora install libreswan -y

# Libreswan EC2의 공인 IP export LEFT_PUBLIC_IP=$(aws ec2 describe-instances \ --filters "Name=tag:Name,Values=onprem-server" "Name=instance-state-name,Values=running" \ --query 'Reservations[0].Instances[0].PublicIpAddress' \ --output text)

export LEFT_PUBLIC_IP_2=$LEFT_PUBLIC_IP

export LEFT_SUBNET="10.10.0.0/16" # 온프레미스 VPC 서브넷

# VPN connection id export VPN_CONNECTION_ID=$(aws ec2 describe-vpn-connections \ --filters "Name=tag:Name,Values=onprem-to-cloud-vpn" "Name=state,Values=available" \ --query 'VpnConnections[0].VpnConnectionId' \ --output text)

# AWS VPN Gateway의 공인 IP export RIGHT_PUBLIC_IP=$(aws ec2 describe-vpn-connections \ --vpn-connection-ids ${VPN_CONNECTION_ID} \ --query 'VpnConnections[0].VgwTelemetry[0].OutsideIpAddress' \ --output text)

export RIGHT_PUBLIC_IP_2=$(aws ec2 describe-vpn-connections \ --vpn-connection-ids ${VPN_CONNECTION_ID} \ --query 'VpnConnections[0].VgwTelemetry[1].OutsideIpAddress' \ --output text)

export RIGHT_SUBNET="10.20.0.0/16" # Cloud VPC 서브넷

# VPN 첫번째 터널의 사전 공유 키 export PSK_SECRET=$(aws ec2 describe-vpn-connections \ --vpn-connection-ids ${VPN_CONNECTION_ID} \ --query 'VpnConnections[0].Options.TunnelOptions[0].PreSharedKey' \ --output text)

export PSK_SECRET_2=$(aws ec2 describe-vpn-connections \ --vpn-connection-ids ${VPN_CONNECTION_ID} \ --query 'VpnConnections[0].Options.TunnelOptions[1].PreSharedKey' \ --output text)

cat << EOF > /etc/sysctl.conf net.ipv4.ip_forward = 1 net.ipv4.conf.default.rp_filter = 0 net.ipv4.conf.default.accept_source_route = 0 EOF

sudo sysctl -p

cat << EOF > /etc/ipsec.d/aws.conf conn Tunnel1 authby=secret auto=start left=%defaultroute leftid=$LEFT_PUBLIC_IP right=$RIGHT_PUBLIC_IP type=tunnel ikelifetime=8h keylife=1h phase2alg = aes256-sha2_256;modp2048 ike=aes128-sha1;modp2048 keyingtries=%forever keyexchange=ike leftsubnet=$LEFT_SUBNET rightsubnet=$RIGHT_SUBNET dpddelay=10 dpdtimeout=30 dpdaction=restart_by_peer overlapip=yes conn Tunnel2 authby=secret auto=start left=%defaultroute leftid=$LEFT_PUBLIC_IP_2 right=$RIGHT_PUBLIC_IP_2 type=tunnel ikelifetime=8h keylife=1h phase2alg = aes256-sha2_256;modp2048 ike=aes128-sha1;modp2048 keyingtries=%forever keyexchange=ike leftsubnet=$LEFT_SUBNET rightsubnet=$RIGHT_SUBNET dpddelay=10 dpdtimeout=30 dpdaction=restart_by_peer overlapip=yes EOF

cat << EOF > /etc/ipsec.d/aws.secrets $LEFT_PUBLIC_IP $RIGHT_PUBLIC_IP : PSK "$PSK_SECRET" $LEFT_PUBLIC_IP_2 $RIGHT_PUBLIC_IP_2 : PSK "$PSK_SECRET_2" EOF

systemctl restart ipsec