我正在尝试在两个AWS区域(俄勒冈和爱尔兰)之间设置VPN。在俄勒冈州，我使用了AWS VPN服务，在爱尔兰，我使用了市场上的vyos EC2实例。
在俄勒冈州，我启动了一个实例，并为ICMP请求(针对测试为0.0.0.0/0)打开了其安全组。我的Vyos实例的安全组也已打开。
双方的VPN均已启动，但我遇到了一个奇怪的问题。
测试1:
从俄勒冈州EC2-Ping到EC2-Vyos的Ping:正常工作
测试2:
从EC2-Vyos ping到EC2-Oregon:无法正常工作
但是，如果在EC2-Oregon上启动了Wireshark，我看到了ICMP请求，则问题似乎出在ICMP答复上:
11.609958 169.254.12.138 -> 10.10.2.45 ICMP 98 Echo (ping) request id=0x2f3d, seq=1/256, ttl=63
11.929702 10.0.1.177 -> 10.10.2.45 ICMP 71 Time-to-live exceeded (Time to live exceeded in transit)
12.610213 169.254.12.138 -> 10.10.2.45 ICMP 98 Echo (ping) request id=0x2f3d, seq=2/512, ttl=63
12.929659 10.0.1.177 -> 10.10.2.45 ICMP 71 Time-to-live exceeded (Time to live exceeded in transit)
13.610111 169.254.12.138 -> 10.10.2.45 ICMP 98 Echo (ping) request id=0x2f3d, seq=3/768, ttl=63
13.929952 10.0.1.177 -> 10.10.2.45 ICMP 71 Time-to-live exceeded (Time to live exceeded in transit)
IPs Informations:
10.0.1.177: EC2-Vyos
10.10.2.45: EC2-Oregon
169.254.12.138: The IP of my vti1 in the Vyos conf
测试3:
将Irlande中的另一个EC2实例Ping到EC2-Oregon:不起作用
但是在EC2-Oregon实例上，又有一次我看到ICMP请求(10.2.10是我在爱尔兰的EC2实例):
0.361551 10.0.2.10 -> 10.10.2.45 ICMP 98 Echo (ping) request id=0x130d, seq=4/1024, ttl=62
0.361569 10.10.2.45 -> 10.0.2.10 ICMP 98 Echo (ping) reply id=0x130d, seq=4/1024, ttl=64
0.627332 10.0.1.177 -> 10.10.2.45 ICMP 71 Time-to-live exceeded (Time to live exceeded in transit)
1.369717 10.0.2.10 -> 10.10.2.45 ICMP 98 Echo (ping) request id=0x130d, seq=5/1280, ttl=62
我不明白问题所在。
我的vyos配置:
interfaces {
ethernet eth0 {
address dhcp
duplex auto
hw-id 0a:14:25:f4:8f:e9
smp_affinity auto
speed auto
}
loopback lo {
}
vti vti0 {
address 169.254.12.62/30
description "VPC tunnel 1"
mtu 1436
}
vti vti1 {
address 169.254.12.138/30
description "VPC tunnel 2"
mtu 1436
}
}
protocols {
bgp 65000 {
neighbor 169.254.12.61 {
remote-as 7224
soft-reconfiguration {
inbound
}
timers {
holdtime 30
keepalive 30
}
}
neighbor 169.254.12.137 {
remote-as 7224
soft-reconfiguration {
inbound
}
timers {
holdtime 30
keepalive 30
}
}
network 10.0.0.0/16 {
}
}
static {
route 10.0.0.0/16 {
next-hop 10.0.1.1 {
}
}
}
}
service {
ssh {
disable-password-authentication
port 22
}
}
system {
config-management {
commit-revisions 20
}
console {
device ttyS0 {
speed 9600
}
}
host-name VyOS-AMI
login {
user vyos {
authentication {
encrypted-password "*"
public-keys aws_key-XXXXXX {
key AAAAB3....
type ssh-rsa
}
}
level admin
}
}
ntp {
server 0.pool.ntp.org {
}
server 1.pool.ntp.org {
}
server 2.pool.ntp.org {
}
}
package {
auto-sync 1
repository community {
components main
distribution helium
password ""
url http://packages.vyos.net/vyos
username ""
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone UTC
}
vpn {
ipsec {
esp-group AWS {
compression disable
lifetime 3600
mode tunnel
pfs enable
proposal 1 {
encryption aes128
hash sha1
}
}
ike-group AWS {
dead-peer-detection {
action restart
interval 15
timeout 30
}
key-exchange ikev1
lifetime 28800
proposal 1 {
dh-group 2
encryption aes128
hash sha1
}
}
ipsec-interfaces {
interface eth0
}
nat-traversal enable
site-to-site {
peer 52.XX.XXX.113 {
authentication {
id 52.XX.XXX.132
mode pre-shared-secret
pre-shared-secret 7bRiFaXXXXXX
remote-id 52.XX.XXX.113
}
connection-type initiate
description "VPC tunnel 1"
ike-group AWS
local-address 10.0.1.177
vti {
bind vti0
esp-group AWS
}
}
peer 54.186.XXX.33 {
authentication {
id 52.XX.XXX.132
mode pre-shared-secret
pre-shared-secret AT2Q4XXXXXXXXXX
remote-id 54.XXX.XXX.33
}
connection-type initiate
description "VPC tunnel 2"
ike-group AWS
local-address 10.0.1.177
vti {
bind vti1
esp-group AWS
}
}
}
}
}
更新:
问题解决了。
您可以在此repo https://github.com/mboret/aws-vyos上找到整个配置过程(正常工作)
最佳答案
最终，随着Vyos的升级，我的问题得以解决。 (此问题源于VyOS的358和405错误，已在version 1.1.2中修复。)
解决方案(在Vyos实例上，而不是在“配置”模式下):
add system image http://packages.vyos.net/iso/release/1.1.5/vyos-1.1.5-amd64.iso
(Press Enter and answer Yes at each question).
reboot
现在，我可以ping通并通过VPN连接进行访问。唯一仍然无法正常工作的是test2，Vyos实例无法ping通VPN，但对我而言并不重要，其他所有实例都可以通过VPN访问。
我已经使用设置AWS区域间VPN的过程创建了一个存储库:https://github.com/mboret/aws-vyos
关于amazon-web-services - 带有VYOS的AWS Inter Region VPN，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/34440607/