apache/cloudstack — pull request #54 by remibergsma (2014-12-08 18:39:21+00:00)
Title: make the VPN feature work more reliable and secure

At Schuberg Philis we wanted to use the VPN feature, but found it hard to make it work in a reliable way. When we dove into it, we found some bugs and problems that we solved along the way. Since this change, the VPN connections are created and destroyed as expected. Also, we tightened the iptable rules to make it more secure.

The patched ipsectunnel.sh script works fine in our tests on 4.4, 4.5 and 4.6. Possibly also on 4.3.x when the fix for CLOUDSTACK-5501 is merged.

Also, after rebooting a VPC the VPN connection reconnected as one would expect.

We tested this change by using the shell script below (based on CloudMonkey). The script will create a VPN connection between each VPN customer gateway it finds, like in a mesh network.

Regards,
Remi Bergsma / Funs Kessen

#!/bin/bash
vpncustgws=`cloudmonkey list vpncustomergateways | grep ^id | awk ' { print $3 }'`
vpngws=`cloudmonkey list vpngateways | grep ^id | awk ' { print $3 }'`
for vpngw in $vpngws
do
pubip=`cloudmonkey list vpngateways id=$vpngw | grep ^publicip | awk '{print $3}'`
echo "dealing with $vpngw, $pubip"
for vpncustgw in $vpncustgws
do
custgw=`cloudmonkey list vpncustomergateways id=$vpncustgw | grep ^gateway | awk '{print $3}'`
if [ $custgw == $pubip ]
then
echo "$pubip is me, $vpncustgw, $custgw, $vpngw!"
else
echo "creating vpn: $custgw, $pubip"
echo "cloudmonkey create vpnconnection s2scustomergatewayid=$vpncustgw s2svpngatewayid=$vpngw"
fi
done
done