Deploying S2S VPN using strongSwan in Yandex Cloud

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

1. Create a s2s-vpn-sa service account:

   yc iam service-account create --name s2s-vpn-sa
   

   Result:

   id: nfersamh4sjq********
   folder_id: b1gc1t4cb638********
   created_at: "2023-03-21T10:36:29.726397755Z"
   name: s2s-vpn-sa
   

   Save the ID of the s2s-vpn-sa service account (id) and the ID of the folder where you created it (folder_id).

2. Assign the resource-manager.admin, iam.admin, compute.admin, and vpc.admin roles for the folder to the service account:

   yc resource-manager folder add-access-binding <folder_ID> \
     --role resource-manager.admin \
     --subject serviceAccount:<service_account_ID>
   
   yc resource-manager folder add-access-binding <folder_ID> \
     --role iam.admin \
     --subject serviceAccount:<service_account_ID>
   
   yc resource-manager folder add-access-binding <folder_ID> \
     --role compute.admin \
     --subject serviceAccount:<service_account_ID>
   
   yc resource-manager folder add-access-binding <folder_ID> \
     --role vpc.admin \
     --subject serviceAccount:<service_account_ID>
   

   Result:

   done (1s)
   

To create a service account, use the create method for the ServiceAccount resource or the ServiceAccountService/Create gRPC API call.

To assign the roles for a folder to a service account, use the setAccessBindings method for the ServiceAccount resource or the ServiceAccountService/SetAccessBindings gRPC API call.

Run this command:

yc vpc network create s2s-vpn-network

Result:

id: enp1gg8kr3pv********
folder_id: b1gt6g8ht345********
created_at: "2023-12-20T20:08:11Z"
name: s2s-vpn-network
default_security_group_id: enppne4l2eg5********

To create a cloud network, use the create REST API method for the Network resource or the NetworkService/Create gRPC API call.

If you do not have OpenSSH installed yet, follow this guide to install it.

1. Run cmd.exe or powershell.exe (make sure to update PowerShell before doing so).

2. Use the ssh-keygen command to create a new key:

   ssh-keygen -t ed25519 -C "<optional_comment>"
   

   You can specify an empty string in the -C parameter to avoid adding a comment, or you may not specify the -C parameter at all: in this case, a default comment will be added.

   After running this command, you will be prompted to specify the name and path to the key files, as well as enter the password for the private key. If you only specify the name, the key pair will be created in the current directory. The public key will be saved in a file with the .pub extension, while the private key, in a file without extension.

   By default, the command prompts you to save the key under the id_ed25519 name in the following folder: C:\Users\<username>/.ssh. If there is already an SSH key named id_ed25519 in this directory, you may accidentally overwrite it and lose access to the resources it is used in. Therefore, you may want to use unique names for all SSH keys.

Create keys using the PuTTY app:

1. Download and install PuTTY.

2. Add the folder with PuTTY to the PATH variable:

   1. Click Start and type Change system environment variables in the Windows search bar.
   2. Click Environment Variables... at the bottom right.
   3. In the window that opens, find the PATH parameter and click Edit.
   4. Add your folder path to the list.
   5. Click OK.

3. Launch the PuTTYgen app.

4. Select EdDSA as the pair type to generate. Click Generate and move the cursor in the field above it until key creation is complete.

   

5. In Key passphrase, enter a strong password. Enter it again in the field below.

6. Click Save private key and save the private key. Do not share its key phrase with anyone.

7. Click Save public key and save the public key to a file named <key_name>.pub.

Run this command:

yc vpc subnet update <name_of_automatically_created_subnet> \
  --route-table-name=<name_of_automatically_created_table>

Result:

id: e9b6n3jj3gh6********
folder_id: b1g681qpemb4********
created_at: "2024-05-19T13:24:58Z"
name: ipsec-sgw-ru-central1-b
network_id: enppoggov6ub********
zone_id: ru-central1-b
v4_cidr_blocks:
  - 10.1.0.0/16
route_table_id: enp4v8foko6s********
dhcp_options: {}

To associate a route table with a subnet, use the update REST API method for the Subnet resource or the SubnetService/Update gRPC API call.