{"id":20697418,"url":"https://github.com/epomatti/aws-s2s-vpn","last_synced_at":"2026-05-05T10:31:36.124Z","repository":{"id":240434755,"uuid":"801329710","full_name":"epomatti/aws-s2s-vpn","owner":"epomatti","description":"AWS VPN connection with Netgate pfSense","archived":false,"fork":false,"pushed_at":"2024-05-20T20:08:18.000Z","size":248,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-01-17T18:34:40.099Z","etag":null,"topics":["acm","acmpca","aws","aws-security","azure","azure-security","ipsec","letsencrypt","netgate","pfsense","terraform","vpn"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/epomatti.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-05-16T02:55:46.000Z","updated_at":"2024-05-20T20:08:21.000Z","dependencies_parsed_at":"2024-05-18T21:25:55.538Z","dependency_job_id":"27c5c510-713c-42dd-ab7e-adb23adb2797","html_url":"https://github.com/epomatti/aws-s2s-vpn","commit_stats":null,"previous_names":["epomatti/aws-s2s-vpn"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Faws-s2s-vpn","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Faws-s2s-vpn/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Faws-s2s-vpn/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Faws-s2s-vpn/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/epomatti","download_url":"https://codeload.github.com/epomatti/aws-s2s-vpn/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":242961747,"owners_count":20213315,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["acm","acmpca","aws","aws-security","azure","azure-security","ipsec","letsencrypt","netgate","pfsense","terraform","vpn"],"created_at":"2024-11-17T00:17:57.080Z","updated_at":"2026-05-05T10:31:36.097Z","avatar_url":"https://github.com/epomatti.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# AWS Site-to-Site VPN\n\nIPSec connection between AWS VPN and Netgate pfSense from the Azure Marketplace.\n\n\u003cimg src=\".assets/aws-pfsense.png\" /\u003e\n\n## Setup\n\n### 1. Create the Azure resources\n\nCopy the `.auto.tfvars` template:\n\n```sh\ncp azure/config/template.tfvars azure/.auto.tfvars\n```\n\nSet your IP CIDR address for management of the Azure resources:\n\n```terraform\nlocal_administrator_cidr = \"1.2.3.4\"\n```\n\n\u003e [!CAUTION]\n\u003e Watch out for the `enable_acmpca` variable. AWS ACM Private Certificate Authority is an expensive service with monthly fees. Do **not** set it to `true` unless you intend to do so.\n\nCreate a key pair to use for the Virtual Machines configuration:\n\n```sh\nmkdir azure/keys\nssh-keygen -f azure/keys/temp_key\nchmod 600 azure/keys/temp_key\n```\n\nApply and create the resources:\n\n```sh\nterraform -chdir=\"azure\" init\nterraform -chdir=\"azure\" apply -auto-approve\n```\n\nConnect with SSH and check VM startup script:\n\n```sh\ncloud-init status\n```\n\nConnect to pfSense and setup the initial WAN configuration:\n\n- Username: `admin`\n- Password: `pfsense`\n\nNow, create the AWS infrastructure and continue the Azure configuration in the next section.\n\n\n### 2. Create the AWS resources\n\nCopy the `.auto.tfvars` template:\n\n```sh\ncp aws/config/template.tfvars aws/.auto.tfvars\n```\n\nGet the pfSense public IP running on Azure and set in the configuration:\n\n```terraform\ncustomer_gateway_ip_address = \"1.2.3.4\"\n```\n\nInit and apply the Terraform configuration:\n\n```sh\nterraform -chdir=\"aws\" init\nterraform -chdir=\"aws\" apply -auto-approve\n```\n\nIn the VPC console, open the VPN Connection and download the configuration:\n\n- Vendor: `Generic`\n- Platform: `Generic`\n- Software: `Vendor Agnostic`\n- IKE version: `ikev2`\n\nConnect using SSM Session Manager and check the instance startup script:\n\n```sh\ncloud-init status\n```\n\n### 3. Set the AWS tunnel IPs into the Azure configuration\n\nWhile in the AWS VPN section, get the `Outside IP address` for the IPSec tunnels.\n\nGo back to the Azure configuration, and set the IP addresses for each tunnel:\n\n```terraform\naws_remote_gateway_ip_address_tunnel_1 = \"5.6.7.8\"\naws_remote_gateway_ip_address_tunnel_2 = \"4.3.2.1\"\n```\n\nReapply the configuration:\n\n```sh\nterraform -chdir=\"azure\" apply -auto-approve\n```\n\n### 4. Configure pfSense IPSec\n\n#### IPSec\n\nFollow the steps detailed in the instructions downloaded from AWS for a Generic provider, add Phase 1 and Phase 2 configuration in pfSense.\n\n\u003cimg src=\".assets/aws-pfsense-ipsec-tunnels.png\" /\u003e\n\n#### Firewall rules\n\nAdd the firewall rules to allow traffic within the tunnels:\n\n- IPSec\n- WAN\n\n### 5. Testing\n\nAt this point, everything should be working and traffic flowing from both sides.\n\nRun `ping` commands and calling NGINX from each side for testing.\n\n## Let's Encrypt certificates\n\nTo protect pfSense with TLS, here're some guidelines to do that with Let's Encrypt.\n\n### Installation (WSL)\n\nConsidering usage with WSL:\n\n```sh\nsudo -e /etc/wsl.conf\n```\n\nAdd the configuration for `systemd`:\n\n```toml\n[boot]\nsystemd=true\n```\n\nRestart WSL:\n\n```sh\nwsl --shutdown\n```\n\nFollow the [instructions][1] to install **Certbot** into your box.\n\n### Issue certificates\n\nIssuing a certificate manually:\n\n```sh\nsudo certbot certonly --manual --preferred-challenges dns \\\n    -d \u003cyour domain\u003e \\\n    -m \u003cyour email\u003e\n```\n\nLocation where the certifications will be available:\n\n```\nCertificate is saved at: /etc/letsencrypt/live/vpn-azure.example.com/fullchain.pem\nKey is saved at:         /etc/letsencrypt/live/vpn-azure.example.com/privkey.pem\n```\n\n## Finding Azure images\n\nCommand used to find the pfSense marketplace image:\n\n```sh\naz vm image list --location eastus2 --publisher netgate --offer pfsense-plus-public-cloud-fw-vpn-router --sku pfsense-plus-public-tac-lite --all\n```\n\nAdditional search commands:\n\n```sh\naz vm image list-publishers --location eastus2 --query [].name --output table | grep netgate\naz vm image list-offers --location eastus2 --publisher netgate --output table\naz vm image list-skus --location eastus2 --publisher netgate --offer pfsense-plus-public-cloud-fw-vpn-router --query [].name --output table\n```\n\n## Clean-up\n\nDestroy both Azure and AWS resources:\n\n```sh\nterraform -chdir=\"azure\" destroy -auto-approve\nterraform -chdir=\"aws\" destroy -auto-approve\n```\n\n## Reference\n\n- [How to Setup Site to Site VPN between AWS and PFsense?](https://youtu.be/p83RmeT2Q-A)\n- [Setup Site-to-Site VPN to AWS with pfSense](https://c86.medium.com/setup-site-to-site-vpn-to-aws-with-pfsense-1cac16623bd6)\n- [IP Sec VPN Fundamentals](https://youtu.be/15amNny_kKI)\n- [How do I create a certificate-based VPN using AWS Site-to-Site VPN?](https://www.youtube.com/watch?v=nz__4KBKIGE)\n\n\n[1]: https://certbot.eff.org/\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fepomatti%2Faws-s2s-vpn","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fepomatti%2Faws-s2s-vpn","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fepomatti%2Faws-s2s-vpn/lists"}