> For the complete documentation index, see [llms.txt](https://ysfang82.gitbook.io/development-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ysfang82.gitbook.io/development-notes/aws-notes/service/networking/vpn.md).

# VPN

**Introduction**

* Connection for on-premise to VPC. **Not for VPC to VPC.**

**Site to Site VPN (AWS managed VPN)**

* On-premise
  * Setup a software / hardware VPN appliance to on-premise network
  * The on-premise VPN should be accessible with a public IP
* AWS side
  * Setup a Virtual Private Gateway (VGW), **not IGW**. And attach to the VPC (1 VPC can only attach utmost 1 VGW)
  * Setup Customer Gateway to point the on-premise VPN appliance
* 2 VPN connections (tunnels) are created for redundancy, encrypted with IPSec for one Site to Site VPN
* Can have another Site to Site VPN with a different Customer Gateway to connect to the same VGW for HA
* Can optionally accelerate it with [Global Accelerator](https://aws.amazon.com/tw/global-accelerator/?blogs-global-accelerator.sort-by=item.additionalFields.createdDate\&blogs-global-accelerator.sort-order=desc\&aws-global-accelerator-wn.sort-by=item.additionalFields.postDateTime\&aws-global-accelerator-wn.sort-order=desc) (for worldwide networks)

![Site to Site VPN](https://3303577320-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M4cDbT2F2VmcAohuhSN%2F-MF0joKH-AZ1sfahcYHq%2F-MF0lDlN96MACaY1AOiv%2FScreen%20Shot%202020-08-18%20at%209.31.39%20PM.png?alt=media\&token=f06baf3e-12f0-49a6-af48-0eed02e53082)

**Route Propagation in Site-to-site VPN**

![Route Propagation in Site-to-site VPN](https://3303577320-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M4cDbT2F2VmcAohuhSN%2F-MF0joKH-AZ1sfahcYHq%2F-MF0mrv3tViamqBrR7vI%2FScreen%20Shot%202020-08-18%20at%209.37.28%20PM.png?alt=media\&token=a892c946-5792-429f-86b4-e3eac5d7ce72)

* Routing Options:
  * Static Routing:
    * Create static route in corporate data center for 10.0.0.1/24 through the CGW
    * Create static route in AWS for 10.3.0.0/20 through VGW
  * Dynamic Routing ([BGP](https://en.wikipedia.org/wiki/Border_Gateway_Protocol)):
    * Like GPS navigator, the best route is determined by different factors, such as traffic congestion, roads temporarily closed for maintenance, etc. The path is calculated dynamically depending on the situation of the network nodes.
    * Uses BGP (Border Gateway Protocol) to share routes automatically (eBGP for internet)
    * No need to update Routing Tables
    * Just need to specify the ASN (Autonomous System Number) of the CGW and VGW
    * It's optional for VPN. (But required for Direct Connect)

**Site to Site VPN and Internet access**

![Site to Site Internet Access with NAT Gateway / NAT Instance](https://3303577320-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M4cDbT2F2VmcAohuhSN%2F-MF0joKH-AZ1sfahcYHq%2F-MF0oTId9JYDRGl1vrQD%2FScreen%20Shot%202020-08-18%20at%209.45.49%20PM.png?alt=media\&token=fc21ce40-87f4-4a73-8e9a-3a8d8c776276)

![Site to Site Internet Access with on-premise NAT](https://3303577320-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M4cDbT2F2VmcAohuhSN%2F-MF0joKH-AZ1sfahcYHq%2F-MF0ozGg1PTGV8jXBMkE%2FScreen%20Shot%202020-08-18%20at%209.48.09%20PM.png?alt=media\&token=5e512ed8-7241-420c-9ced-015e7845932d)

**AWS VPN CloudHub**

* Usage:
  * Can connect up to 10 Customer Gateways for each Virtual Private Gateway (VGW)
  * Low cost hub-and-spoke model for connectivity between locations
* Can be a failover connection between locations.

![CloudHub](https://3303577320-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M4cDbT2F2VmcAohuhSN%2F-MF0pfuYyXPFLHMvRFUK%2F-MF0rE-ajMLF3H4fSX5m%2FScreen%20Shot%202020-08-18%20at%209.58.01%20PM.png?alt=media\&token=bc51b4ca-5a41-40f6-adb3-41ed3b79f2bf)

**AWS Client VPN**

* Connect from your computer with OpenVPN to your private network in AWS and on-premise

![](https://3303577320-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M4cDbT2F2VmcAohuhSN%2F-MF0pfuYyXPFLHMvRFUK%2F-MF13YTpfRxUjJ9ehJO_%2FScreen%20Shot%202020-08-18%20at%2010.56.09%20PM.png?alt=media\&token=b8be2e74-3cfb-4242-a04c-c2af71baa767)

**Non-AWS Software VPN**

* Can setup your own software VPN, but have to manage everything including bandwidth, redendancy, etc.

![Non-AWS Software VPN](https://3303577320-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M4cDbT2F2VmcAohuhSN%2F-MF0pfuYyXPFLHMvRFUK%2F-MF17BhMBZl33EV3R9NN%2FScreen%20Shot%202020-08-18%20at%2011.12.06%20PM.png?alt=media\&token=187d5dd3-2908-42da-8fff-55a7f97033c7)

VPN to multiple VPC

* For VPN-based customers, AWS recommends creating a separate VPN connection for each customer VPC.
* Direct Connect is recommended

![VPN to multiplc VPC](https://3303577320-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M4cDbT2F2VmcAohuhSN%2F-MF0pfuYyXPFLHMvRFUK%2F-MF1854xHljoHN28H0mB%2FScreen%20Shot%202020-08-18%20at%2011.16.00%20PM.png?alt=media\&token=6e238227-3712-40f2-a1c2-a2fc70ad571b)