Ruslan Khozinov rkhozinov

Creating a dynamic site-to-site VPN with OpenSwan on Ubuntu 10.04 on EC2

There are many tutorials floating around the web that almost get you a dynamic VPN in EC2. The goal of this tutorial is to be a one-stop-shop for this specific setup.

VyOS AMI Customization

rl-system.init

comment-out followings

update_interface_config
to prevent new interface is added when stop/start instance in EC2 classic or create imaage with existing interface
add_new_serial_if || log_failure_msg "can't add serial interfaces"
no serial interface in EC2

	error_message:
	ru: \|
	Не понял! /help
	en: \|
	I'm dummy, sorry! /help

	help_head:
	ru: \|
	Привет! Я туду-лист с напоминалками, буду куковать тебе о важных вещах,
	чтобы ты не забыл.

	# https://pypi.python.org/pypi/RandomWords/0.1.5

	host=172.16.10.254
	port=9200
	title=$(python -c "import random_words; print ' '.join(random_words.RandomWords().random_words(count=2))")
	content=$(python -c "import random_words; print ' '.join(random_words.RandomWords().random_words(count=10))")
	app=$(($RANDOM % 3 + 1))
	timestamp=$(date +"%Y-%m-%d %H:%M:%S")

	data="

	import pytest
	import testinfra
	import unittest
	import pprint
	import pytest

	class TestDevopsPortal:
	def setup(self):
	self.b = testinfra.get_backend("local://")
	print ("basic setup into class")

	# Glusterfs library: http://libgfapi-python.readthedocs.io/en/latest/
	# Glusterfs library Volume API: http://libgfapi-python.readthedocs.io/en/latest/api-reference.html#volume-class
	# Docker library: https://docker-py.readthedocs.io/en/stable/
	# Testinfra docs: http://testinfra.readthedocs.io/en/latest/
	# Pytest docs: https://docs.pytest.org/en/latest/example/simple.html
	# Run pytest from python: https://docs.pytest.org/en/latest/usage.html#calling-pytest-from-python-code
	# Pytest logging: http://pythontesting.net/framework/pytest/pytest-logging-real-time/

	import testinfra
	import pytest

	#include<stdio.h>
	#include<stdlib.h>
	#include<locale.h>
	#include<string.h>
	#include<windows.h>

	void insertion_sort(int *a,int t) //сортировка вставками
	{
	int i,j,temp;
	for (i=1;i<t;i++)

	[ssh_connection]
	ssh_args = -F ssh.cfg
	control_path = ~/.ssh/mux-%r@%h:%p

	Server 2 sockets,6 cores each, 2.4ghz

	# Set ixgbe options
	# Limit RSS queues to the number of physical cores per cpu
	# Disable offload
	# When you change this, you need to run the command and reboot for it to take.
	echo "options ixgbe LRO=0,0 MQ=1,1 RSS=6,6 VMDQ=0,0 vxlan_rx=0,0" > /etc/modprobe.d/ixgbe.conf

	# Shut down HT cores
	for i in $(seq 1 2 23); do

	# Virtual Tunnel Interface
	# 172.196.17.188 - 172.196.17.191
	set interfaces vti vti0 address 172.196.17.190/30
	set interfaces vti vti0 description 'Virtual tunnel interface for VPN tunnel'

	# Phase 2
	set vpn ipsec esp-group ESP-Default compression 'disable'
	set vpn ipsec esp-group ESP-Default lifetime '3600'
	set vpn ipsec esp-group ESP-Default mode 'tunnel'
	set vpn ipsec esp-group ESP-Default pfs 'dh-group16'

Ruslan Khozinov rkhozinov

Creating a dynamic site-to-site VPN with OpenSwan on Ubuntu 10.04 on EC2

VyOS AMI Customization

rl-system.init

comment-out followings

vyatta-postconfig-bootup.script