03-configuring-aws.md

Configuring AWS

Step-by-step overview

1. Create a VPC with a large network (e.g.: 172.31.0.0/16). This will allow us room for trying other experiments in the future.
2. Carve 2 subnets (e.g.: Private and VPN). Our VM will have a NIC in each one of these subnets.
3. Create the OpenBSD VM with two NICs
   1. For each NIC disable source/dest check allowing packet forwarding
4. Add the route to Azure (e.g.: 10.0.0.0/16)
5. Allow traffic on the Security Groups (ports 500, 4500 UDP)
   1. For troubleshooting, also allow ICMP and SSH between the two networks.
6. Attach an Elastic IP to the OpenBSD interface on the VPN subnet.
7. Configure OpenIKED.

References:

• Example: Create an IPv4 VPC and Subnets Using the AWS CLI

Create the VPC

Go to the VPC section

1. Click on the Services drop-down menu.
2. and select VPC under the Networking & Content Delivery section

1. Choose a name for your VPC
2. Select a CIDR block. In our example: 172.31.0.0/16
3. Click on Yes, Create

Attach an Internet Gateway

By default, a newly created VPC will not route traffic to the Internet. To allow the access to the Internet, we will create a new Internet Gateway and attach it to the VPC.

1. Click on Internet Gateways.
2. Click on the Create Internet Gateway button.

1. Give the gateway a name (e.g.: internet-gw)
2. Click on Yes, Create

Select the new Internet Gateway and click on Attach to VPC

1. Click on Attack to VPC
2. Select the VPC
3. Click on Yes, Attach

The final result should look like this.

Carve the subnets

1. Click on Subnets under the Virtual Private Cloud section on the left-side navigation bar.
2. Click on the Create Subnets button

In this windows you can select all of the details of the subnets such as the:

1. name of the subnet
2. VPC to create the subnet
3. Availability Zone and
4. the CIDR

Repeat this process for the subnets for the following subnets and CIDRs.

Name	CIDR	Nb of Hosts
VPN	172.31.255.128/25	126
Private	172.31.0.0/19	8190

Create the OpenBSD instance

If you've executed the steps described on the Before You Begin section you should now have an OpenBSD AMI ready for consumption. Let's proceed by creating the instance.

Go to EC2

1. Click on the Services drop-down menu.
2. and select EC2 under the Compute section

1. Click on the EC2 Dashboard
2. Click on Launch Instance

NOTE: Note that we are creating our resources in the Oregon region. If you are using a different region, please change that here.

1. Click on My AMIs
2. Select your OpenBSD image

From here, follow the rest of the configuration guide and choose an instance type (for testing purposes, I've used a t2.micro instance.)

1. Select your instance size
2. Click on Next: Configure Instance Details

1. Select your VPC
2. Select the subnet for the first (main) interface
3. Add a new interface and select the subnet that it will be attached to.
4. Click on Review and Launch

NOTE: If you are deploying this in production, I'd recommend you check the Enable termination protection option (the red arrow is pointing to that option). This is an extra safe mechanism that will prevent the accidental termination of your instance.

The last modification is to add rules to the Security Groups.

1. Click on Edit security groups

AWS Security Group Add Rules

1. To add a new rule, click on Add Rule.

We need to create the following rules:

Type	Protocol	Port Range	Source	Description
SSH	TCP	22	Custom: 0.0.0.0/0	Note that you can lock this to your public IP if you wanted. We will lock this down with PF as well.
All ICMP - IPv4	ICMP	0-65535	Custom: Azure CIDR	From Azure
Custom UDP	UDP	500	Custom: Azure CIDR	From Azure - IPsec
Custom UDP	UDP	4500	Custom: Azure CIDR	From Azure - IPsec

When you are done with the rules here, go ahead and click on Review and Launch and finally, under the 7.Review section click on Launch.

The last step is to select a key pair or to create one if needed. If you already have a key, here's what you need to do:

1. Click on Choose an existing key pair
2. Select a key pair and acknowledge that you have the private key.
3. Click on Launch Instances

After the instance is ready, return to the Instances section and put a meaningful name to the instance. This will help you to easily identify this instance later.

1. Click on Instances
2. Click on the pen icon to edit the name of the instance.

We will also add a name to our network interfaces.

1. Click on the Network Interfaes under NETWORK & SECURITY
2. Name the Primary network interface as ext_if
3. Name the second interface as int_if.

Allow packet forwarding

Go to EC2

1. Click on the Services drop-down menu.
2. and select EC2 under the Compute section

Disable source/destination check

1. Click on the Network Interfaces
2. Select a network interface (e.g.: the external_if interface). Note that you must do this for both interfaces.
3. Click on Change Source/Dest. Check under the Actions button.

When the Change Source/Dest. Check window appears:

1. Select Disabled
2. Click save.

Repeat this process for all interfaces that need to pass traffic.

Allow Traffic

Attach EIP

1. Click on the Elastic IPs under NETWORK & SECURITY
2. Click on Allocate new address

1. Next, click on Allocate

Back to the main Elastic IPs screen, right click on your newly allocated address and choose Associate address

1. Right click on the new EIP and then click on Associate address

1. Under Resource type select Network interface
2. Click on the Network interface drop-down menu and select the ext_if interface
3. Click on Associate

Route Table Overview

Destination	Target	Notes
172.31.0.0/16	local	VPC CIDR
0.0.0.0/0	Internet Gateway
10.0.0.0/0	xfn1 / OpenBSD	Route to Azure's VNET pointing to OpenBSD's internal NIC interface

Add a route to Azure's VNet

Next, create the route table entry.

1. Under the Virtual Private Cloud, select Route Tables
2. Select the subnet which you want to add the route. In our example, we will select the private-us-west-2a one.
3. Click ont he Routes tab
4. and then click on Edit

Once inside of the route table

1. Click on Add another route
2. Under the Destination field, write Azure's VNet CIDR. In our exercise 10.0.0.0/16.
3. Select OpenBSDs internal interface. You can either search for the name of the interface (e.g.: eni-XXXX) or search for a tag (e.g.: internal_if)
4. Click on Save

Your route table should look like resemble this one:

Next: Setting up OpenBSD