Skip to content
This repository was archived by the owner on Mar 3, 2022. It is now read-only.

Commit 5f96df8

Browse files
jjwarzechajjwarzecha
committed
#jj - renaming of directory, refactoring and some configuration corrections
1 parent 479acaa commit 5f96df8

16 files changed

+144
-141
lines changed

examples/oci/vpn_sandbox/.gitignore renamed to examples/oci/libreswan_ipsec_vpn_basic/.gitignore

File renamed without changes.

examples/oci/vpn_sandbox/README.md renamed to examples/oci/libreswan_ipsec_vpn_basic/README.md

File renamed without changes.

examples/oci/vpn_sandbox/generate_files.tf renamed to examples/oci/libreswan_ipsec_vpn_basic/compute_generate_files.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ conn oci1
4848
#local
4949
right=${var.cpe_ip_address} #on Premises Libreswan network
5050
rightid=${var.cpe_ip_address} #AWS Libreswan Public IP address
51-
rightsubnet=${var.vcn_vpn_on_premises_cidr_block} #on Premises CIDR
51+
rightsubnet=${var.on_premises_cidr_block} #on Premises CIDR
5252
OCICONF
5353
}
5454

examples/oci/vpn_sandbox/instances.tf renamed to examples/oci/libreswan_ipsec_vpn_basic/compute_instances.tf

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
resource "oci_core_instance" "server01" {
2-
availability_domain = "${oci_core_subnet.sub01be.availability_domain}"
2+
availability_domain = "${oci_core_subnet.subnet01.availability_domain}"
33
compartment_id = "${var.compartment_ocid}"
44
display_name = "server01"
55
shape = "${var.instance_shape}"
66

77
source_details {
8-
source_id = "${var.instance_image_ocid[ var.region ]}"
8+
source_id = "${var.instance_image_ocid[var.region]}"
99
source_type = "image"
1010
}
1111

1212
create_vnic_details {
13-
subnet_id = "${oci_core_subnet.sub01be.id}"
13+
subnet_id = "${oci_core_subnet.subnet01.id}"
1414
hostname_label = "server01"
1515
skip_source_dest_check = true
16-
assign_public_ip = false
16+
assign_public_ip = true
1717
}
1818

1919
metadata {
@@ -27,21 +27,21 @@ resource "oci_core_instance" "server01" {
2727
}
2828

2929
resource "oci_core_instance" "server02" {
30-
availability_domain = "${oci_core_subnet.sub02be.availability_domain}"
30+
availability_domain = "${oci_core_subnet.subnet02.availability_domain}"
3131
compartment_id = "${var.compartment_ocid}"
3232
display_name = "server02"
3333
shape = "${var.instance_shape}"
3434

3535
source_details {
36-
source_id = "${var.instance_image_ocid[ var.region ]}"
36+
source_id = "${var.instance_image_ocid[var.region]}"
3737
source_type = "image"
3838
}
3939

4040
create_vnic_details {
41-
subnet_id = "${oci_core_subnet.sub02be.id}"
41+
subnet_id = "${oci_core_subnet.subnet02.id}"
4242
hostname_label = "server02"
4343
skip_source_dest_check = true
44-
assign_public_ip = false
44+
assign_public_ip = true
4545
}
4646

4747
metadata {
@@ -55,21 +55,21 @@ resource "oci_core_instance" "server02" {
5555
}
5656

5757
resource "oci_core_instance" "server03" {
58-
availability_domain = "${oci_core_subnet.sub03be.availability_domain}"
58+
availability_domain = "${oci_core_subnet.subnet03.availability_domain}"
5959
compartment_id = "${var.compartment_ocid}"
6060
display_name = "server03"
6161
shape = "${var.instance_shape}"
6262

6363
source_details {
64-
source_id = "${var.instance_image_ocid[ var.region ]}"
64+
source_id = "${var.instance_image_ocid[var.region]}"
6565
source_type = "image"
6666
}
6767

6868
create_vnic_details {
69-
subnet_id = "${oci_core_subnet.sub03be.id}"
69+
subnet_id = "${oci_core_subnet.subnet03.id}"
7070
hostname_label = "server03"
7171
skip_source_dest_check = true
72-
assign_public_ip = false
72+
assign_public_ip = true
7373
}
7474

7575
metadata {

examples/oci/vpn_sandbox/instances_output.tf renamed to examples/oci/libreswan_ipsec_vpn_basic/compute_instances_output.tf

File renamed without changes.

examples/oci/vpn_sandbox/userdata-webservers.tf renamed to examples/oci/libreswan_ipsec_vpn_basic/compute_userdata-webservers.tf

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,15 @@
11
variable "user-data-webservers" {
22
default = <<EOF
33
#!/bin/bash -x
4-
#
5-
echo '################### webserver userdata begins #####################'
6-
touch ~opc/userdata.`date +%s`.start
74
8-
# echo '########## yum update all ###############'
9-
# yum update -y
5+
echo '################### webserver userdata begins #####################'
106
117
echo '########## basic webserver ##############'
128
yum install -y httpd
139
systemctl enable httpd.service
1410
systemctl start httpd.service
1511
1612
echo '<html><head></head><body><pre><code>' > /var/www/html/index.html
17-
1813
hostname >> /var/www/html/index.html
1914
echo '' >> /var/www/html/index.html
2015
cat /etc/os-release >> /var/www/html/index.html
@@ -28,13 +23,7 @@ echo '</code></pre></body></html>' >> /var/www/html/index.html
2823
firewall-offline-cmd --add-service=http
2924
systemctl enable firewalld
3025
systemctl restart firewalld
31-
# systemctl stop firewalld
3226
33-
touch ~opc/userdata.`date +%s`.finish
3427
echo '################### webserver userdata ends #######################'
3528
EOF
3629
}
37-
38-
# curl ifconfig.co >> /var/www/html/index.html
39-
# curl ifconfig.co >> /var/www/html/index.html
40-

examples/oci/vpn_sandbox/configuration.tf renamed to examples/oci/libreswan_ipsec_vpn_basic/configuration.tf

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
////// environment setup ///////
22
variable "instance_shape" {
3-
default = "VM.Standard1.1"
3+
default = "VM.Standard2.1"
44
}
55

66
variable "instance_image_ocid" {
@@ -16,31 +16,34 @@ variable "instance_image_ocid" {
1616
}
1717
}
1818

19-
data "oci_identity_availability_domains" "ADs" {
19+
data "oci_identity_availability_domains" "ads" {
2020
compartment_id = "${var.compartment_ocid}"
2121
}
2222

23+
//VCN local CIDR block
2324
variable "vcn_vpn_cidr_block" {
2425
description = "VCN IP range"
2526
default = "172.31.0.0/16"
2627
}
2728

29+
//VCN local subnets
2830
variable "vcn_vpn_subnets_cidr_blocks" {
29-
description = "VCN IP range"
31+
description = "VCN subnets"
3032
default = ["172.31.0.0/24", "172.31.1.0/24", "172.31.2.0/24"]
3133
}
3234

3335
variable "cpe_ip_address" {
3436
//update to your external IP ADDRESS
35-
default = "127.0.0.1"
37+
default = "1.2.3.4"
3638
}
3739

3840
variable "ipsec_static_routes" {
3941
// ipsec encryption domain
4042
default = ["0.0.0.0/0"]
4143
}
4244

43-
variable "vcn_vpn_on_premises_cidr_block" {
44-
description = "VCN IP range"
45+
//On premises LAN IP range
46+
variable "on_premises_cidr_block" {
47+
description = "On premises IP range"
4548
default = "10.20.0.0/16"
4649
}

examples/oci/vpn_sandbox/env-vars.tf.example renamed to examples/oci/libreswan_ipsec_vpn_basic/env-vars.tf.example

File renamed without changes.

examples/oci/vpn_sandbox/img/oci_vpn_example.png renamed to examples/oci/libreswan_ipsec_vpn_basic/img/oci_vpn_example.png

File renamed without changes.

‎examples/oci/libreswan_ipsec_vpn_basic/net_acls.tf‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
resource "oci_core_security_list" "security_list_default" {
2+
display_name = "security_list_default"
3+
compartment_id = "${oci_core_virtual_network.vcn_vpn.compartment_id}"
4+
vcn_id = "${oci_core_virtual_network.vcn_vpn.id}"
5+
6+
egress_security_rules = [{ protocol = "all" destination = "0.0.0.0/0" }]
7+
ingress_security_rules = [
8+
{ tcp_options { "max" = 22 "min" = 22 } protocol = "6" source = "${var.cpe_ip_address}/32" },
9+
{ protocol = "all" source = "${var.on_premises_cidr_block}"},
10+
// example of tcp rule
11+
{ tcp_options { "max" = 22 "min" = 22 } protocol = "6" source = "192.168.255.255/32" },
12+
// icmp protocol for troubleshooting
13+
{ icmp_options { "type" = 0 } protocol = 1 source = "0.0.0.0/0" },
14+
{ icmp_options { "type" = 3 "code" = 4 } protocol = 1 source = "0.0.0.0/0" },
15+
{ icmp_options { "type" = 8 } protocol = 1 source = "0.0.0.0/0" }
16+
]
17+
}
18+
19+
# Additional security list for local subnet
20+
resource "oci_core_security_list" "local_sec_list_01" {
21+
display_name = "local_security_list_01"
22+
compartment_id = "${oci_core_virtual_network.vcn_vpn.compartment_id}"
23+
vcn_id = "${oci_core_virtual_network.vcn_vpn.id}"
24+
egress_security_rules = [
25+
{ protocol = "all" destination = "0.0.0.0/0" },
26+
]
27+
ingress_security_rules = [
28+
{ protocol = "all" source = "${var.vcn_vpn_cidr_block}" },
29+
{ protocol = 1 source = "0.0.0.0/0" stateless = true icmp_options { "type" = 3 "code" = 3} },
30+
{ protocol = 1 source = "0.0.0.0/0" stateless = true icmp_options { "type" = 3 "code" = 4} },
31+
{ protocol = 1 source = "0.0.0.0/0" stateless = true icmp_options { "type" = 0 "code" = 1} },
32+
{ protocol = 1 source = "0.0.0.0/0" stateless = true icmp_options { "type" = 8 "code" = 1} },
33+
]
34+
}
35+
36+
# Additional security list for local subnet
37+
resource "oci_core_security_list" "local_sec_list_02" {
38+
display_name = "local_security_list_02"
39+
compartment_id = "${oci_core_virtual_network.vcn_vpn.compartment_id}"
40+
vcn_id = "${oci_core_virtual_network.vcn_vpn.id}"
41+
egress_security_rules = [
42+
{ protocol = "all" destination = "0.0.0.0/0" },
43+
]
44+
ingress_security_rules = [
45+
{ protocol = "all" source = "${var.vcn_vpn_cidr_block}" },
46+
{ protocol = 1 source = "0.0.0.0/0" stateless = true icmp_options { "type" = 3 "code" = 3} },
47+
{ protocol = 1 source = "0.0.0.0/0" stateless = true icmp_options { "type" = 3 "code" = 4} },
48+
{ protocol = 1 source = "0.0.0.0/0" stateless = true icmp_options { "type" = 0 "code" = 1} },
49+
{ protocol = 1 source = "0.0.0.0/0" stateless = true icmp_options { "type" = 8 "code" = 1} },
50+
]
51+
}
52+
53+
# Additional security list for local subnet
54+
resource "oci_core_security_list" "local_sec_list_03" {
55+
display_name = "local_security_list_03}"
56+
compartment_id = "${oci_core_virtual_network.vcn_vpn.compartment_id}"
57+
vcn_id = "${oci_core_virtual_network.vcn_vpn.id}"
58+
egress_security_rules = [
59+
{ protocol = "all" destination = "0.0.0.0/0" },
60+
]
61+
ingress_security_rules = [
62+
{ protocol = "all" source = "${var.vcn_vpn_cidr_block}" },
63+
{ protocol = 1 source = "0.0.0.0/0" stateless = true icmp_options { "type" = 3 "code" = 3} },
64+
{ protocol = 1 source = "0.0.0.0/0" stateless = true icmp_options { "type" = 3 "code" = 4} },
65+
{ protocol = 1 source = "0.0.0.0/0" stateless = true icmp_options { "type" = 0 "code" = 1} },
66+
{ protocol = 1 source = "0.0.0.0/0" stateless = true icmp_options { "type" = 8 "code" = 1} },
67+
]
68+
}

0 commit comments

Comments
 (0)