Home / server / Questions / 542983
In Process
Jeff Strunk
Asked: 2013-10-02 06:33:56 +0800 CST

How to connect a data center network to a cloud provider with VPN

  • 772

We have our production environment on EC2 classic, and we have a lease on some servers in a managed hosting environment. We would like to put a portion of our backend service in the data center, but there is no security built into the application yet, so we need to rely on private networks and VPN. I think this will be easier once we migrate to VPC as AWS already provides this kind of service, but we are not there yet.

Network Description

EC2 Classic puts all instances in 10.0.0.0/8. Our data center also has a subnet within that range, but I suspect we can change that. There are two routers at the data center that can connect an IPSEC VPN.

Service Description

The services running in the data center need to be able to initiate connections to services in EC2 and also receive connections initiated by services in EC2.

Ideas

I'm sure that if our services at the data center only needed to initiate connections to services in EC2, then it would just be a matter of setting up VPN endpoints in EC2 for the routers at the data center to connect to, use a different subnet in the data center, and finally, route all connections to 10.0.0.0/8 over the VPN.

For the other direction, is the best option to configure an extra route on all EC2 instances that need to initiate connections to services in the data center?

networking

2 Answers

  1. You need to put your instances inside an Amazon VPC, with what Amazon calls a "hardware connection" to your datacenter. There are two scenarios for this : http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenarios.html I won't copy-paste what the document already says as it's pretty descriptive.

    Scenario 3 and 4 are relevant to your use case.

    For your specific questions

    • Network description: Yes, you can change the IP range in which your VPC lies
    • Service description: This is possible once you setup the VPN connection between your VPC and your datacenter
    • "is the best option to configure an extra route on all EC2 instances"? - You will be configuring a routing table in your VPC subnet for this which will route traffic meant for your datacenter through the VPN connection.
    • 1

  2. You may use 'Endian' or pfSense to create IPSec Site to Site VPNs. Both have small footprints and easy to configure with good documentation and even with video tutorials.

    http://www.pfsense.org/

    http://www.endian.com/

    • 0